Install and run InfluxDB 3 Explorer

Use Docker to install and run InfluxDB 3 Explorer.

Control who can reach Explorer

Anyone who can reach the Explorer port can use the InfluxDB connection that you configure in Explorer, with that token’s permissions. By default, Docker publishes a container port on all network interfaces (0.0.0.0) and adds its own firewall rules, which can take effect even when a host firewall (such as ufw or firewalld) is set to block the port.

The examples in this guide publish Explorer on the loopback interface (127.0.0.1) so it’s reachable only from the same machine. Before you make Explorer reachable from other hosts, see Network exposure and access control.

Quick start
Installation methods
Configuration options
Advanced configuration
Complete examples

Quick start

Get InfluxDB 3 Explorer running in minutes:

Run the Explorer container:

docker run --detach \
  --name influxdb3-explorer \
  --publish 127.0.0.1:8888:8080 \
  influxdata/influxdb3-ui:1.9.0

Access the Explorer UI at http://localhost:8888
Configure your InfluxDB connection in the UI

Installation methods

Prerequisites

Install Docker or Docker Desktop if you haven’t already.

Basic setup

To get the latest updates, run the following command before starting the container:

docker pull influxdata/influxdb3-ui:1.9.0

Docker run Docker Compose

docker run --detach \
  --name influxdb3-explorer \
  --publish 127.0.0.1:8888:8080 \
  influxdata/influxdb3-ui:1.9.0

# docker-compose.yml
version: '3.8'

services:
  explorer:
    image: influxdata/influxdb3-ui:1.9.0
    container_name: influxdb3-explorer
    ports:
      - "127.0.0.1:8888:8080"
    volumes:
      - ./config:/app-root/config:ro
    restart: unless-stopped

Start the container:

docker-compose up -d

Run Explorer against a production instance

Use this setup to run Explorer with persistence, admin mode, and automatic image updates when administering a production InfluxDB 3 instance.

This setup is for running Explorer in a controlled environment–for example, on an operator’s workstation or a restricted host–to administer a production InfluxDB 3 instance. It isn’t a recipe for hosting Explorer as a publicly reachable service. The examples bind Explorer to 127.0.0.1; before changing that, see Network exposure and access control.

Docker run Docker Compose

docker run --detach \
  --name influxdb3-explorer \
  --pull always \
  --publish 127.0.0.1:8888:8080 \
  --volume $(pwd)/db:/db:rw \
  --volume $(pwd)/config:/app-root/config:ro \
  --env SESSION_SECRET_KEY=$(openssl rand -hex 32) \
  --restart unless-stopped \
  influxdata/influxdb3-ui:1.9.0 \
  --mode=admin

# docker-compose.yml
version: '3.8'

services:
  explorer:
    image: influxdata/influxdb3-ui:1.9.0
    container_name: influxdb3-explorer
    pull_policy: always
    command: ["--mode=admin"]
    ports:
      - "127.0.0.1:8888:8080"
    volumes:
      - ./db:/db:rw
      - ./config:/app-root/config:ro
      - ./ssl:/etc/nginx/ssl:ro
    environment:
      SESSION_SECRET_KEY: ${SESSION_SECRET_KEY:-changeme123456789012345678901234}
    restart: unless-stopped

Create a .env file that contains the following:

SESSION_SECRET_KEY=your_32_char_hex_string_here

Start the container:

docker-compose up -d

Configuration options

Network exposure and access control

Explorer holds the InfluxDB connection details and token that you configure in it. Access to the Explorer interface is effectively access to that InfluxDB connection, so treat reaching the Explorer port the same as holding the token.

Use the following practices to control access:

Bind to the loopback interface for local use. The examples in this guide publish Explorer as 127.0.0.1:8888:8080, which makes it reachable only from the same machine. To reach Explorer from your browser on that machine, open http://localhost:8888.
Expose Explorer deliberately, not by default. To reach Explorer from another host, replace 127.0.0.1 with the specific interface address you intend to use (for example, 192.0.2.10:8888:8080). Publishing without an address (8888:8080) binds to all interfaces (0.0.0.0).
Account for Docker and the host firewall. Docker publishes ports by adding its own firewall rules, which can take effect even when a host firewall such as ufw or firewalld is configured to block the port. Verify reachability from another host rather than assuming the host firewall applies.
Put authentication in front of remote access. If you need to reach Explorer over a network, run it on the loopback interface and place an authenticating reverse proxy with TLS in front of it (for example, NGINX or Caddy).
Prefer least-privilege tokens. The token you configure in Explorer determines what anyone with access to Explorer can do. Use a token scoped to what the task requires.

Persist data across restarts

InfluxDB 3 Explorer stores application data in a SQLite database. To persist this data across container restarts:

Create a local directory:
```
mkdir -m 700 ./db
```

Mount the directory when running the container:

Docker Docker Compose

docker run --detach \
  --name influxdb3-explorer \
  --publish 127.0.0.1:8888:8080 \
  --volume $(pwd)/db:/db:rw \
  influxdata/influxdb3-ui:1.9.0

version: '3.8'

services:
  explorer:
    image: influxdata/influxdb3-ui:1.9.0
    container_name: influxdb3-explorer
    ports:
      - "127.0.0.1:8888:8080"
    volumes:
      - ./db:/db:rw
    restart: unless-stopped

Without a mounted ./db directory, application data is lost when the container is deleted.

With v1.7.0+, the Explorer container runs as a non-root user. If you’re upgrading from v1.6.x or earlier with mounted volumes, update file ownership before you start the container. The container exits with an error if mounted volumes have incorrect ownership.

Set file permissions for upgrades

In v1.7.0+, the Explorer container runs as a non-root user (influxui, uid 1500) for improved security. Because earlier versions ran as root, existing mounted volumes are owned by root and the new non-root process can’t access them.

If you start the upgraded container without updating file ownership, it exits with the following error:

ERROR: Directory '/db' is owned by root and not accessible to the 'influxui' user.

To prevent or resolve this error, change ownership of your mounted directories to uid 1500 before you start the container. For example:

sudo chown -R 1500:1500 /path/to/your/db
sudo chown -R 1500:1500 /path/to/your/config

After you update ownership, restart the container. Fresh installations are unaffected.

Pre-configure InfluxDB connections

Instead of configuring connections through the UI, you can pre-define connection settings using a config.json file. This is useful for:

Automated deployments
Shared team configurations
Quick setup for known environments

Create a config.json file:
```
mkdir -p config
cat > config/config.json << 'EOF'
{
  "DEFAULT_INFLUX_SERVER": "http://host.docker.internal:8181",
  "DEFAULT_INFLUX_DATABASE": "mydb",
  "DEFAULT_API_TOKEN": "your-token-here",
  "DEFAULT_SERVER_NAME": "Local InfluxDB 3"
}
EOF
```
Customize the following properties for your InfluxDB 3 instance:
- DEFAULT_INFLUX_SERVER: your InfluxDB 3 Core or Enterprise server URL
- DEFAULT_INFLUX_DATABASE: the name of your InfluxDB 3 Core or Enterprise database
- DEFAULT_API_TOKEN: your InfluxDB 3 Core or Enterprise authorization token with the necessary permissions to access your server
- DEFAULT_SERVER_NAME: a display name (only used by Explorer) for your InfluxDB 3 Core or Enterprise server
When to use host.docker.internal
If your InfluxDB 3 instance is running on the Docker host, either natively or in a separate container with port 8181 published, use host.docker.internal as the server host–for example:
```
"DEFAULT_INFLUX_SERVER": "http://host.docker.internal:8181"
```
- If both Explorer and InfluxDB are in the same Docker network, use the container name instead.
- Docker Desktop provides host.docker.internal automatically. On Linux Docker Engine, map the hostname when you start Explorer: --add-host=host.docker.internal:host-gateway with docker run, or extra_hosts: ["host.docker.internal:host-gateway"] with Docker Compose.
For Docker Desktop details, see the Docker Desktop networking documentation. For Linux Docker Engine details, see the Docker daemon documentation.

Mount the configuration directory:

Docker Docker Compose

docker run --detach \
  --name influxdb3-explorer \
  --add-host=host.docker.internal:host-gateway \
  --publish 127.0.0.1:8888:8080 \
  --volume $(pwd)/config:/app-root/config:ro \
  influxdata/influxdb3-ui:1.9.0

version: '3.8'

services:
  explorer:
    image: influxdata/influxdb3-ui:1.9.0
    container_name: influxdb3-explorer
    extra_hosts:
      - "host.docker.internal:host-gateway"
    ports:
      - "127.0.0.1:8888:8080"
    volumes:
      - ./config:/app-root/config:ro
    restart: unless-stopped

Enable TLS/SSL (HTTPS)

To enable TLS/SSL for secure connections:

Create SSL directory and add certificate files:

mkdir -m 755 ./ssl
# Copy your certificate files to the ssl directory
cp /path/to/server.crt ./ssl/
cp /path/to/server.key ./ssl/

Required files:

Certificate: server.crt or fullchain.pem
Private key: server.key

Run the container with SSL enabled:

Docker Docker Compose

docker run --detach \
  --name influxdb3-explorer \
  --publish 127.0.0.1:8888:8443 \
  --volume $(pwd)/ssl:/etc/nginx/ssl:ro \
  influxdata/influxdb3-ui:1.9.0

version: '3.8'

services:
  explorer:
    image: influxdata/influxdb3-ui:1.9.0
    container_name: influxdb3-explorer
    ports:
      - "127.0.0.1:8888:8443"
    volumes:
      - ./ssl:/etc/nginx/ssl:ro
    restart: unless-stopped

Access the Explorer UI at https://localhost:8888

The nginx web server automatically detects and uses certificate files in the mounted path.

TLS and certificate verification options

Use the following environment variables to configure TLS and certificate verification:

NODE_EXTRA_CA_CERTS - Path to custom CA certificate file inside container (recommended).
This option adds an intermediate or custom CA certificate to the Node.js trusted certificate store and is required when InfluxDB uses certificates signed by an internal or private CA.
- Format: PEM format certificate file
- Example: -e NODE_EXTRA_CA_CERTS=/ca-certs/ca-bundle.crt
This is the native Node.js environment variable for custom CAs.
CA_CERT_PATH - Alternative to NODE_EXTRA_CA_CERTS (convenience alias)
- Example: -e CA_CERT_PATH=/ca-certs/ca-bundle.crt
Use either NODE_EXTRA_CA_CERTS or CA_CERT_PATH; not both. CA_CERT_PATH aliases NODE_EXTRA_CA_CERTS.

Use self-signed certificates

To configure Explorer to trust self-signed or custom CA certificates when connecting to InfluxDB:

Create a directory for CA certificates:
```
mkdir -p ./ca-certs
```
Copy your CA certificate to the directory:
```
cp /path/to/your-ca.pem ./ca-certs/
```
Mount the CA certificate directory and set the NODE_EXTRA_CA_CERTS environment variable:

View example Docker configuration for self-signed certificates

Choose operational mode

InfluxDB 3 Explorer supports two operational modes:

Query mode (default): Read-only UI for querying data
Admin mode: Full UI with administrative capabilities

Set the mode using the --mode parameter:

Docker Docker Compose

# Query mode (default)
docker run --detach \
  --name influxdb3-explorer \
  --publish 127.0.0.1:8888:8080 \
  influxdata/influxdb3-ui:1.9.0 \
  --mode=query

# Admin mode
docker run --detach \
  --name influxdb3-explorer \
  --publish 127.0.0.1:8888:8080 \
  influxdata/influxdb3-ui:1.9.0 \
  --mode=admin

version: '3.8'

services:
  explorer:
    image: influxdata/influxdb3-ui:1.9.0
    container_name: influxdb3-explorer
    # For query mode (default), omit the command
    # For admin mode, add:
    command: ["--mode=admin"]
    ports:
      - "127.0.0.1:8888:8080"
    restart: unless-stopped

Advanced configuration

Environment variables

Variable	Default	Description
`SESSION_SECRET_KEY`	(random)	Secret key for session management. Set this in production to persist sessions across restarts.
`DATABASE_URL`	`/db/sqlite.db`	Path to SQLite database inside container
`SSL_CERT_PATH`	`/etc/nginx/ssl/cert.pem`	Path to SSL certificate file
`SSL_KEY_PATH`	`/etc/nginx/ssl/key.pem`	Path to SSL private key file
`NODE_EXTRA_CA_CERTS`	(none)	Path to custom CA certificate file (PEM format) for trusting self-signed or internal CA certificates
`CA_CERT_PATH`	(none)	Alias for `NODE_EXTRA_CA_CERTS`

Always set SESSION_SECRET_KEY in production to persist user sessions across container restarts. Enter the following command to generate a secure key:

openssl rand -hex 32

Volume reference

Container Path	Purpose	Permissions	Required
`/db`	SQLite database storage	700	No (but recommended)
`/app-root/config`	Connection configuration	755	No
`/etc/nginx/ssl`	TLS/SSL certificates	755	Only for HTTPS
`/ca-certs`	Custom CA certificates	755	Only for self-signed certificates

Port reference

Container Port	Protocol	Purpose	Common Host Mapping
8080	HTTP	Web UI (unencrypted)	8888
8443	HTTPS	Web UI (encrypted)	8888

Complete examples

Full configuration with all features

Docker Docker Compose

# Create required directories
mkdir -m 700 ./db
mkdir -m 755 ./config ./ssl

# Generate session secret
export SESSION_SECRET=$(openssl rand -hex 32)

# Create configuration
cat > config/config.json << 'EOF'
{
  "DEFAULT_INFLUX_SERVER": "http://host.docker.internal:8181",
  "DEFAULT_INFLUX_DATABASE": "production",
  "DEFAULT_API_TOKEN": "your-production-token",
  "DEFAULT_SERVER_NAME": "Production InfluxDB 3"
}
EOF

# Run Explorer with all features
docker run --detach \
  --name influxdb3-explorer \
  --add-host=host.docker.internal:host-gateway \
  --pull always \
  --publish 127.0.0.1:8888:8443 \
  --volume $(pwd)/db:/db:rw \
  --volume $(pwd)/config:/app-root/config:ro \
  --volume $(pwd)/ssl:/etc/nginx/ssl:ro \
  --env SESSION_SECRET_KEY=$SESSION_SECRET \
  --restart unless-stopped \
  influxdata/influxdb3-ui:1.9.0 \
  --mode=admin

# docker-compose.yml
version: '3.8'

services:
  explorer:
    image: influxdata/influxdb3-ui:1.9.0
    container_name: influxdb3-explorer
    pull_policy: always
    command: ["--mode=admin"]
    extra_hosts:
      - "host.docker.internal:host-gateway"
    ports:
      - "127.0.0.1:8888:8443"
    volumes:
      - ./db:/db:rw
      - ./config:/app-root/config:ro
      - ./ssl:/etc/nginx/ssl:ro
    environment:
      SESSION_SECRET_KEY: ${SESSION_SECRET_KEY}
    restart: unless-stopped

Create a .env file that contains the following:

SESSION_SECRET_KEY=your_32_char_hex_string_here

Start the container:

docker-compose up -d

Development setup (minimal)

Docker Docker Compose

docker run --rm \
  --name influxdb3-explorer \
  --publish 127.0.0.1:8888:8080 \
  influxdata/influxdb3-ui:1.9.0

# docker-compose.yml
version: '3.8'

services:
  explorer:
    image: influxdata/influxdb3-ui:1.9.0
    container_name: influxdb3-explorer
    ports:
      - "127.0.0.1:8888:8080"

Was this page helpful?

Thank you for your feedback!

Support and feedback

Thank you for being part of our community! We welcome and encourage your feedback and bug reports for InfluxDB 3 Explorer and this documentation. To find support, use the following resources:

Customers with an annual or support contract can contact InfluxData Support.

Edit this page Submit docs issue Submit InfluxDB 3 Explorer issue

Install and run InfluxDB 3 Explorer

Control who can reach Explorer

Quick start

Installation methods

Prerequisites

Basic setup

Run Explorer against a production instance

Configuration options

Network exposure and access control

Persist data across restarts

Set file permissions for upgrades

Pre-configure InfluxDB connections

When to use `host.docker.internal`

Enable TLS/SSL (HTTPS)

TLS and certificate verification options

Use self-signed certificates

Choose operational mode

Advanced configuration

Environment variables

Volume reference

Port reference

Complete examples

Full configuration with all features

Development setup (minimal)

Support and feedback

InfluxDB OSS 2.9.0: API tokens are hashed by default

Key enhancements in Explorer 1.9

InfluxDB 3.10 is now available

InfluxDB 3.10 is now available

Telegraf Enterprise is now generally available

InfluxDB Docker latest tag changing to InfluxDB 3 Core

Install and run InfluxDB 3 Explorer

Control who can reach Explorer

Quick start

Installation methods

Prerequisites

Basic setup

Run Explorer against a production instance

Configuration options

Network exposure and access control

Persist data across restarts

Set file permissions for upgrades

Pre-configure InfluxDB connections

When to use host.docker.internal

Enable TLS/SSL (HTTPS)

TLS and certificate verification options

Use self-signed certificates

Choose operational mode

Advanced configuration

Environment variables

Volume reference

Port reference

Complete examples

Full configuration with all features

Development setup (minimal)

Support and feedback

Where are you running InfluxDB?

Thank you for your feedback!

InfluxDB OSS 2.9.0: API tokens are hashed by default

Key enhancements in Explorer 1.9

InfluxDB 3.10 is now available

InfluxDB 3.10 is now available

Telegraf Enterprise is now generally available

InfluxDB Docker latest tag changing to InfluxDB 3 Core

When to use `host.docker.internal`