Install n8n Using Docker (Beginner Guide)

I’ve deployed n8n in Docker on fresh servers where one missing volume or mis-set webhook URL caused hours of debugging later.

Install n8n Using Docker (Beginner Guide) walks you through a clean, repeatable setup with persistence, safer defaults, and a practical path to HTTPS for U.S.-based SaaS integrations.

What you’ll set up (and why it matters)

n8n is often the “glue” between U.S.-centric services (Google Workspace, Slack, Stripe, HubSpot, Salesforce, Notion, OpenAI, and more). When your instance is unstable, every automation downstream becomes flaky.

Docker Engine + Docker Compose so deployments are consistent across machines.
Persistent storage so workflows and credentials survive restarts.
Encryption key control so credentials stay readable after upgrades/moves.
Correct webhook URLs so external services can reach you reliably.
A production-ready HTTPS option when you move beyond localhost.

Prerequisites you should confirm first

A Linux server or local machine with Docker installed (or a U.S.-hosted VPS if you want public webhooks).
A domain/subdomain pointing to your server IP if you plan to use HTTPS webhooks.
Basic terminal access (SSH) and permission to run Docker commands.

Install Docker Engine using the official instructions: Docker Engine on Ubuntu.

Docker’s real weakness (and how to avoid it)

Docker makes installs easy, but beginners often forget persistence. If you run a container without a volume, a restart can wipe your local state (workflows, encryption files, settings). The fix is simple: always mount a persistent volume to /home/node/.n8n (and keep it even if you later move to PostgreSQL).

Install Docker Compose (recommended)

For most setups, Compose is the easiest way to keep n8n upgrades clean and reproducible. Install the official Docker Compose plugin: Install the Docker Compose plugin.

Docker Compose’s real weakness (and how to avoid it)

Compose files tend to grow into “mystery meat” if you copy/paste them and never document your variables. The fix is to keep a simple project folder, use an .env file for values you change, and upgrade by pulling images and restarting—no ad-hoc edits on production boxes.

Option A: Fast local start (best for learning)

This is the quickest way to open the n8n editor and start building. It maps port 5678 and mounts a persistent volume.

Official Docker install reference: n8n Docker installation.

docker run -it --rm \

  --name n8n \

  -p 5678:5678 \

  -e GENERIC_TIMEZONE="America/New_York" \

  -e TZ="America/New_York" \

  -e N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS=true \

  -e N8N_RUNNERS_ENABLED=true \

  -v n8n_data:/home/node/.n8n \

  docker.n8n.io/n8nio/n8n

Local mode weakness (and how to avoid it)

The biggest limitation is webhooks: external platforms won’t be able to reach your localhost reliably. If you’re testing triggers like Stripe, Slack, or Google OAuth callbacks, switch to a public server with HTTPS and set a proper WEBHOOK_URL (shown below).

Option B: Production-friendly Docker Compose with HTTPS

If you want reliable webhooks for U.S.-based SaaS integrations, you’ll eventually need HTTPS on a public domain. n8n’s official Docker Compose server setup uses a reverse proxy and TLS automation.

Official Compose setup reference: n8n Docker Compose server setup.

Reverse proxy requirement (webhooks)

When n8n sits behind a reverse proxy, you must explicitly set the webhook URL and proxy hops so n8n generates and registers correct callback URLs. Official reference: Configure webhook URLs with reverse proxy.

Encryption key requirement (don’t skip this)

n8n encrypts stored credentials using an encryption key. If you move servers, rebuild containers, or scale to workers later, controlling this key prevents “credentials suddenly unreadable” incidents. Official reference: Set a custom encryption key.

Create your project folder

mkdir -p n8n-compose

cd n8n-compose

mkdir -p local-files

Create a .env file (your only “moving parts”)

Use a subdomain (for example, n8n.yourdomain.com) and a real email for certificate issuance.

DOMAIN_NAME=example.com

SUBDOMAIN=n8n

GENERIC_TIMEZONE=America/New_York

SSL_EMAIL=you@example.com

# Use a long random string; keep it backed up.

N8N_ENCRYPTION_KEY=replace-with-a-long-random-string

# Your public webhook base URL (must be https in production)

WEBHOOK_URL=https://n8n.example.com/

# Proxy hops when running behind a reverse proxy (typical single proxy setup)

N8N_PROXY_HOPS=1

.env weakness (and how to avoid it)

The most common failure is losing the encryption key after a rebuild. If that happens, saved credentials may become unusable. The fix: store N8N_ENCRYPTION_KEY in a secure place (password manager or secrets vault) and treat it like a database password.

Create compose.yaml (Traefik + n8n)

This pattern exposes HTTPS publicly on 443 while keeping n8n’s internal port 5678 bound to localhost for safety. Traefik is a common reverse proxy choice in Docker environments: Traefik.

services:

  traefik:

    image: traefik

    restart: always

    command:

      - "--providers.docker=true"

      - "--providers.docker.exposedbydefault=false"

      - "--entrypoints.web.address=:80"

      - "--entrypoints.web.http.redirections.entryPoint.to=websecure"

      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"

      - "--entrypoints.websecure.address=:443"

      - "--certificatesresolvers.mytlschallenge.acme.tlschallenge=true"

      - "--certificatesresolvers.mytlschallenge.acme.email=${SSL_EMAIL}"

      - "--certificatesresolvers.mytlschallenge.acme.storage=/letsencrypt/acme.json"

    ports:

      - "80:80"

      - "443:443"

    volumes:

      - traefik_data:/letsencrypt

      - /var/run/docker.sock:/var/run/docker.sock:ro

  n8n:

    image: docker.n8n.io/n8nio/n8n

    restart: always

    ports:

      - "127.0.0.1:5678:5678"

    environment:

      - TZ=${GENERIC_TIMEZONE}

      - GENERIC_TIMEZONE=${GENERIC_TIMEZONE}

      - WEBHOOK_URL=${WEBHOOK_URL}

      - N8N_PROXY_HOPS=${N8N_PROXY_HOPS}

      - N8N_ENCRYPTION_KEY=${N8N_ENCRYPTION_KEY}

      - N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS=true

      - N8N_RUNNERS_ENABLED=true

    volumes:

      - n8n_data:/home/node/.n8n

      - ./local-files:/files

    labels:

      - "traefik.enable=true"

      - "traefik.http.routers.n8n.rule=Host(`${SUBDOMAIN}.${DOMAIN_NAME}`)"

      - "traefik.http.routers.n8n.entrypoints=web,websecure"

      - "traefik.http.routers.n8n.tls=true"

      - "traefik.http.routers.n8n.tls.certresolver=mytlschallenge"

volumes:

  n8n_data:

  traefik_data:

Traefik weakness (and how to avoid it)

Automatic TLS is great—until your DNS is wrong. If the subdomain doesn’t point to the server, certificate issuance fails and you’ll chase “why HTTPS isn’t working.” The fix is to validate DNS first (A record points to the correct public IP), then start Compose.

Start n8n

docker compose up -d

docker compose ps

Open your instance:

Local mode: http://localhost:5678
HTTPS mode: https://n8n.example.com

Quick comparison: local vs HTTPS production path

Setup	Best for	Strength	Common failure	Fix
Docker run (localhost)	Learning nodes, building workflows	Fast start, minimal moving parts	Webhooks don’t work for external services	Move to a public domain + HTTPS and set WEBHOOK_URL
Docker Compose + reverse proxy	Real SaaS triggers and reliable automation	Stable deploys, easier upgrades, HTTPS	Wrong DNS breaks TLS issuance	Verify A record before starting, then restart Compose

Hardening essentials you should apply early

Keep 5678 private in production: bind to 127.0.0.1 and expose only via HTTPS proxy.
Back up your n8n_data volume: it contains critical instance state and encryption artifacts.
Set timezones correctly: use GENERIC_TIMEZONE for scheduled workflows and TZ for container time behavior.
Use strong admin credentials: don’t treat n8n like a disposable dev tool once webhooks go live.

Common mistakes (and the fastest fixes)

1) Webhook test URL looks wrong in the editor

If you see localhost or an internal hostname, external apps in the U.S. won’t be able to call your trigger. Set WEBHOOK_URL to your public HTTPS URL and set N8N_PROXY_HOPS=1 when behind a proxy.

2) “Mismatching encryption keys” after changes

This usually happens when you generated a key on first run, then later set N8N_ENCRYPTION_KEY to something else. Pick one key, keep it consistent, and don’t change it casually once credentials exist.

3) Workflows disappear after restart

This almost always means you didn’t mount a persistent volume to /home/node/.n8n. Add the volume, restart, and from that point onward your changes will survive.

FAQ

Do you need Docker Compose to run n8n?

No—Docker run works for quick learning. Compose becomes the better choice as soon as you care about repeatable upgrades, environment variables, and a clean HTTPS/webhook setup.

Which environment variable matters most for real integrations?

WEBHOOK_URL is the one that prevents “it works locally but not with Stripe/Slack/Google” headaches. If the URL is wrong, external services can’t register or call your triggers correctly behind proxies.

Should you use PostgreSQL from day one?

If you’re just learning, SQLite is fine. Once workflows become business-critical (multiple users, higher execution volume, or compliance requirements), PostgreSQL becomes the more durable baseline—while still keeping the /home/node/.n8n volume for encryption and instance assets.

Can you run n8n without exposing it to the public internet?

Yes. You can keep it local for development or keep it inside a private network/VPN. The moment you need SaaS webhooks from public platforms, you’ll need a public HTTPS endpoint.

What’s the safest upgrade process in Docker?

Pull the latest image and restart the stack. Avoid editing containers manually. Keep your .env stable and your volume backed up.

Why enable task runners?

Task runners are the recommended execution approach in n8n’s Docker setup and help keep runtime behavior consistent across upgrades and environments.

Conclusion

Once n8n is running in Docker with persistent storage, a fixed encryption key, and correct webhook URLs, your automations stop behaving like “experiments” and start acting like dependable infrastructure. Start local if you’re learning, then move to the HTTPS Compose setup the moment you rely on real U.S. SaaS triggers.

Toolient