Stop paying for cloud execution limits. By self-hosting n8n on your own infrastructure, you own your data, eliminate task-based costs, and unlock enterprise-grade automation power.
1The Docker Standard
Docker is a containerization platform that allows you to package n8n and all its dependencies into a single 'container'. This ensures that n8n runs exactly the same on your local laptop as it does on a professional VPS in the cloud.
By using Docker Compose, you can define your entire infrastructure—including the n8n engine, the database, and the reverse proxy—as a simple YAML file. This makes your automation stack portable, version-controlled, and easily reproducible. Instead of clicking through confusing server menus, your infrastructure becomes code.
# docker-compose.yml
version: '3.8'
services:
n8n:
image: n8nio/n8n:latest
restart: always
ports:
- "5678:5678"
environment:
- N8N_HOST=n8n.yourdomain.com
- WEBHOOK_URL=https://n8n.yourdomain.com/2Persistence is Power
Containers are 'ephemeral' by nature—meaning if you stop them or they crash, any data stored inside them is lost. To build a production-ready system, you must use Volumes.
Volumes act as a secure bridge between the container and your host server's physical hard drive. By mounting a volume to /home/node/.n8n, you ensure that your workflows, credentials, and execution history survive container restarts, system updates, and server migrations. Without a volume, your first server reboot will delete your entire automation business.
# Adding persistent storage
services:
n8n:
# ... previous config
volumes:
- n8n_data:/home/node/.n8n
volumes:
n8n_data:
external: false3Vault Security
When you self-host, you are responsible for the security of your API keys. n8n encrypts all credentials in its database, but it requires a master Encryption Key to do so.
You must explicitly set this key in your Docker environment variables. If you lose this key, you will permanently lose access to all connected accounts (OpenAI, Stripe, Salesforce, etc.). Additionally, running n8n behind a reverse proxy (like Traefik or Nginx) ensures all traffic is forced over HTTPS, protecting webhook payloads from being intercepted on the public web.
# Environment Security
services:
n8n:
# ... previous config
environment:
# The master key for the vault
- N8N_ENCRYPTION_KEY=super_secret_string_123!
# Basic Auth for the dashboard
- N8N_BASIC_AUTH_ACTIVE=true
- N8N_BASIC_AUTH_USER=admin
- N8N_BASIC_AUTH_PASSWORD=password_here