# Installation
> Part of the NocoDB documentation (Self-hosting > Installation > Compute Lite). Index of all pages: https://nocodb.com/llms.txt. Any docs page is available as Markdown by adding `.md` to its URL.
URL: https://nocodb.com/docs/self-hosting/installation/compute-lite/install
Last updated: 2026-11-09
Install Compute Lite with Docker Compose, on Kubernetes or on a separate host, and connect it to your self-hosted NocoDB.
Install Compute Lite and connect it to NocoDB. Check the [requirements](/docs/self-hosting/installation/compute-lite#requirements) first.
### Before you begin
The examples pin Compute Lite to the tag `2c607a1381a9`. Pin your own installation to a tag as well, so that a restart never pulls a new version. Do not use `latest` in production.
1. Make an API key. Compute Lite and NocoDB share it.
```bash
openssl rand -hex 24
```
2. Point a wildcard DNS name, such as `*.sandbox.example.com`, at Compute Lite. It must resolve from inside NocoDB. On Kubernetes, use a CoreDNS rewrite or an internal record for the Compute Lite Service.
### 1. Run Compute Lite
1. Add the key to the `.env` file next to `docker-compose.yml`:
```bash
NC_COMPUTE_LITE_KEY=
```
2. Add the service, and add `compute-lite:` under the top-level `volumes:`:
```yaml
compute-lite:
image: nocodb/nc-compute-lite:2c607a1381a9
restart: unless-stopped
privileged: true
ports: ['8431:8431']
environment:
NC_COMPUTE_LITE_KEY: ${NC_COMPUTE_LITE_KEY}
volumes: [compute-lite:/var/lib/docker]
```
Allow only NocoDB to reach port `8431`.
Compute Lite runs as one privileged pod with a volume for its Docker engine. Run one replica only. The namespace must allow privileged pods. With Pod Security Admission, set `pod-security.kubernetes.io/enforce: privileged` on it.
Apply these manifests in the namespace of NocoDB:
```yaml
apiVersion: v1
kind: Secret
metadata:
name: nc-compute-lite
stringData:
NC_COMPUTE_LITE_KEY:
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: nc-compute-lite
spec:
accessModes: [ReadWriteOnce]
resources:
requests:
storage: 50Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: nc-compute-lite
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: nc-compute-lite
template:
metadata:
labels:
app: nc-compute-lite
spec:
containers:
- name: nc-compute-lite
image: nocodb/nc-compute-lite:2c607a1381a9
securityContext:
privileged: true
envFrom:
- secretRef:
name: nc-compute-lite
ports:
- containerPort: 8430
- containerPort: 8431
readinessProbe:
httpGet:
path: /health
port: 8430
resources:
requests:
cpu: '4'
memory: 8Gi
volumeMounts:
- name: docker
mountPath: /var/lib/docker
volumes:
- name: docker
persistentVolumeClaim:
claimName: nc-compute-lite
---
apiVersion: v1
kind: Service
metadata:
name: nc-compute-lite
spec:
selector:
app: nc-compute-lite
ports:
- name: api
port: 8430
- name: proxy
port: 8431
```
Use a NetworkPolicy to allow only NocoDB to reach ports `8430` and `8431`.
Run Compute Lite on its own host to keep untrusted code away from NocoDB:
```bash
docker run -d --name nc-compute-lite --restart unless-stopped --privileged \
-p 8430:8430 -p 8431:8431 \
-v nc-compute-lite:/var/lib/docker \
-e NC_COMPUTE_LITE_KEY= \
nocodb/nc-compute-lite:2c607a1381a9
```
Allow only NocoDB to reach ports `8430` and `8431`.
### 2. Connect NocoDB
Set these three variables on NocoDB. For a separate host, use `http://:8430` as the URL.
Add to the `environment` of the NocoDB service, then run `docker compose up -d`:
```yaml
NC_COMPUTE_LITE_URL: http://compute-lite:8430
NC_COMPUTE_LITE_KEY: ${NC_COMPUTE_LITE_KEY}
NC_COMPUTE_LITE_DOMAIN: sandbox.example.com:8431
```
Add to the NocoDB Deployment. With the Helm chart, use the top-level `extraEnvVars`.
```yaml
- name: NC_COMPUTE_LITE_URL
value: http://nc-compute-lite:8430
- name: NC_COMPUTE_LITE_KEY
valueFrom:
secretKeyRef:
name: nc-compute-lite
key: NC_COMPUTE_LITE_KEY
- name: NC_COMPUTE_LITE_DOMAIN
value: sandbox.example.com:8431
```
`NC_COMPUTE_LITE_DOMAIN` is the wildcard name without `*.`, plus the proxy port. For HTTPS, see [TLS](/docs/self-hosting/installation/compute-lite/configure#serve-the-proxy-over-tls).
### 3. Pull the sandbox images
The chat image is an 8 GB download (about 14 GB on disk), and a first chat that waits more than five minutes for it fails. Pull the four images (`nc-chat-template`, `nc-script-template`, `nc-app-builder`, `nc-app-runtime`) before first use. The exact references are in the release notes of your NocoDB version.
```bash
# Docker Compose
docker compose exec compute-lite docker pull nocodb/nc-chat-template:@sha256:
# Kubernetes
kubectl exec deploy/nc-compute-lite -- docker pull nocodb/nc-chat-template:@sha256:
```
### 4. Check that it works
1. Check that Compute Lite responds with `"ok":true`:
```bash
docker compose exec compute-lite wget -qO- localhost:8430/health
```
On Kubernetes, run `kubectl exec deploy/nc-compute-lite -- wget -qO- localhost:8430/health`.
2. Create a workflow with a **Manual** trigger and a **Run script** step:
```js
output.set('ok', true);
```
3. Run the workflow. It finishes in a few seconds.
4. Ask NocoAI: "Create a CSV of the numbers 1 to 5 and their squares as a downloadable file." You get a CSV file.
If a step fails, see [Troubleshoot](/docs/self-hosting/installation/compute-lite/troubleshoot).
---
## Related pages
- [Compute Lite](https://nocodb.com/docs/self-hosting/installation/compute-lite.md): Compute Lite runs the NocoDB sandboxes for scripts, AI code execution and the App Builder on your own servers, as one Docker container.
- [Configure](https://nocodb.com/docs/self-hosting/installation/compute-lite/configure.md): Settings for Compute Lite and NocoDB: environment variables, TLS, private registries, air-gapped installs and host mode.
- [Upgrade and troubleshoot](https://nocodb.com/docs/self-hosting/installation/compute-lite/troubleshoot.md): Upgrade Compute Lite, read its logs, and fix common problems with NocoDB sandboxes on your own servers.