---
title: Install and run InfluxDB 3 Explorer
description: Use Docker to install and run InfluxDB 3 Explorer.
url: https://docs.influxdata.com/influxdb3/explorer/install/
estimated_tokens: 5351
product: InfluxDB 3 Explorer
version: explorer
publisher: InfluxData
canonical: https://docs.influxdata.com/influxdb3/explorer/install/
date: '2026-06-02T21:26:11-05:00'
lastmod: '2026-06-02T21:26:11-05:00'
---

Use [Docker](https://docker.com) to install and run **InfluxDB 3 Explorer**.

#### Control who can reach Explorer

Anyone who can reach the Explorer port can use the InfluxDB connection that
you configure in Explorer, with that token’s permissions.
By default, Docker publishes a container port on all network interfaces
(`0.0.0.0`) and adds its own firewall rules, which can take effect even when
a host firewall (such as `ufw` or `firewalld`) is set to block the port.

The examples in this guide publish Explorer on the loopback interface
(`127.0.0.1`) so it’s reachable only from the same machine. Before you make
Explorer reachable from other hosts, see[Network exposure and access control](#network-exposure-and-access-control).

* [Quick start](#quick-start)
* [Installation methods](#installation-methods)
* [Configuration options](#configuration-options)
  * [Network exposure and access control](#network-exposure-and-access-control)
  * [Persist data across restarts](#persist-data-across-restarts)
  * [Pre-configure InfluxDB connections](#pre-configure-influxdb-connections)
  * [Enable TLS/SSL (HTTPS)](#enable-tlsssl-https)
    * [TLS and certificate verification options](#tls-and-certificate-verification-options)
    * [Use self-signed certificates](#use-self-signed-certificates)

  * [Choose operational mode](#choose-operational-mode)

* [Advanced configuration](#advanced-configuration)
  * [Environment variables](#environment-variables)
  * [Volume reference](#volume-reference)
  * [Port reference](#port-reference)

* [Complete examples](#complete-examples)

## Quick start

Get InfluxDB 3 Explorer running in minutes:

1. **Run the Explorer container:**

   ```
   docker run --detach \
     --name influxdb3-explorer \
     --publish 127.0.0.1:8888:8080 \
     influxdata/influxdb3-ui:1.8.0
   ```

2. **Access the Explorer UI at [http://localhost:8888](http://localhost:8888)**

3. **[Configure your InfluxDB connection in the UI](/influxdb3/explorer/get-started)**

## Installation methods

### Prerequisites

Install [Docker](https://docs.docker.com/engine/) or [Docker Desktop](https://docs.docker.com/desktop/) if you haven’t already.

### Basic setup

> [!Tip]
> To get the latest updates, run the following command before starting the container:
> ```
> docker pull influxdata/influxdb3-ui:1.8.0
> ```

```bash
docker pull influxdata/influxdb3-ui:1.8.0
```

#### Docker run ####

```bash
docker run --detach \
  --name influxdb3-explorer \
  --publish 127.0.0.1:8888:8080 \
  influxdata/influxdb3-ui:1.8.0
```

```yaml
# docker-compose.yml
version: '3.8'

services:
  explorer:
    image: influxdata/influxdb3-ui:1.8.0
    container_name: influxdb3-explorer
    ports:
      - "127.0.0.1:8888:8080"
    volumes:
      - ./config:/app-root/config:ro
    restart: unless-stopped
```

Start the container:

```bash
docker-compose up -d
```

### Run Explorer against a production instance

Use this setup to run Explorer with persistence, admin mode, and automatic
image updates when administering a production InfluxDB 3 instance.

> [!Caution]
> This setup is for running Explorer in a controlled environment–for example,
> on an operator’s workstation or a restricted host–to administer a production
> InfluxDB 3 instance. It isn’t a recipe for hosting Explorer as a publicly
> reachable service. The examples bind Explorer to `127.0.0.1`; before changing
> that, see [Network exposure and access control](#network-exposure-and-access-control).

#### Docker run ####

```bash
docker run --detach \
  --name influxdb3-explorer \
  --pull always \
  --publish 127.0.0.1:8888:8080 \
  --volume $(pwd)/db:/db:rw \
  --volume $(pwd)/config:/app-root/config:ro \
  --env SESSION_SECRET_KEY=$(openssl rand -hex 32) \
  --restart unless-stopped \
  influxdata/influxdb3-ui:1.8.0 \
  --mode=admin
```

```yaml
# docker-compose.yml
version: '3.8'

services:
  explorer:
    image: influxdata/influxdb3-ui:1.8.0
    container_name: influxdb3-explorer
    pull_policy: always
    command: ["--mode=admin"]
    ports:
      - "127.0.0.1:8888:8080"
    volumes:
      - ./db:/db:rw
      - ./config:/app-root/config:ro
      - ./ssl:/etc/nginx/ssl:ro
    environment:
      SESSION_SECRET_KEY: ${SESSION_SECRET_KEY:-changeme123456789012345678901234}
    restart: unless-stopped
```

Create a `.env` file that contains the following:

```bash
SESSION_SECRET_KEY=your_32_char_hex_string_here
```

Start the container:

```bash
docker-compose up -d
```

## Configuration options

### Network exposure and access control

Explorer holds the InfluxDB connection details and token that you configure in
it. Access to the Explorer interface is effectively access to that InfluxDB
connection, so treat reaching the Explorer port the same as holding the token.

Use the following practices to control access:

* **Bind to the loopback interface for local use.** The examples in this guide
  publish Explorer as `127.0.0.1:8888:8080`, which makes it reachable only from
  the same machine. To reach Explorer from your browser on that machine, open[http://localhost:8888](http://localhost:8888).
* **Expose Explorer deliberately, not by default.** To reach Explorer from
  another host, replace `127.0.0.1` with the specific interface address you
  intend to use (for example, `192.0.2.10:8888:8080`). Publishing without an
  address (`8888:8080`) binds to all interfaces (`0.0.0.0`).
* **Account for Docker and the host firewall.** Docker publishes ports by
  adding its own firewall rules, which can take effect even when a host
  firewall such as `ufw` or `firewalld` is configured to block the port.
  Verify reachability from another host rather than assuming the host firewall
  applies.
* **Put authentication in front of remote access.** If you need to reach
  Explorer over a network, run it on the loopback interface and place an
  authenticating reverse proxy with TLS in front of it (for example,[NGINX](https://nginx.org/en/docs/) or [Caddy](https://caddyserver.com/docs/)).
* **Prefer least-privilege tokens.** The token you configure in Explorer
  determines what anyone with access to Explorer can do. Use a token scoped to
  what the task requires.

### Persist data across restarts

InfluxDB 3 Explorer stores application data in a SQLite database. To persist this data across container restarts:

1. **Create a local directory:**

   ```
   mkdir -m 700 ./db
   ```

2. **Mount the directory when running the container:**

   #### Docker ####

   ```
   docker run --detach \
     --name influxdb3-explorer \
     --publish 127.0.0.1:8888:8080 \
     --volume $(pwd)/db:/db:rw \
     influxdata/influxdb3-ui:1.8.0
   ```

   ```
   version: '3.8'

   services:
     explorer:
       image: influxdata/influxdb3-ui:1.8.0
       container_name: influxdb3-explorer
       ports:
         - "127.0.0.1:8888:8080"
       volumes:
         - ./db:/db:rw
       restart: unless-stopped
   ```

> [!Important]
> Without a mounted `./db` directory, application data is lost when the container is deleted.

> [!Warning]
> With v1.7.0+, the Explorer container runs as a non-root user.
> If you’re upgrading from v1.6.x or earlier with mounted volumes, update file
> ownership before you start the container.
> The container exits with an error if mounted volumes have incorrect ownership.

### Set file permissions for upgrades

In v1.7.0+, the Explorer container runs as a non-root user (`influxui`, uid
1500) for improved security.
Because earlier versions ran as root, existing mounted volumes are owned by
root and the new non-root process can’t access them.

If you start the upgraded container without updating file ownership, it exits
with the following error:

```txt
ERROR: Directory '/db' is owned by root and not accessible to the 'influxui' user.
```

To prevent or resolve this error, change ownership of your mounted directories
to uid 1500 before you start the container.
For example:

```bash
sudo chown -R 1500:1500 /path/to/your/db
sudo chown -R 1500:1500 /path/to/your/config
```

After you update ownership, restart the container.
Fresh installations are unaffected.

### Pre-configure InfluxDB connections

Instead of configuring connections through the UI, you can pre-define connection settings using a `config.json` file. This is useful for:

* Automated deployments
* Shared team configurations
* Quick setup for known environments

1. **Create a `config.json` file:**

   ```
   mkdir -p config
   cat > config/config.json << 'EOF'
   {
     "DEFAULT_INFLUX_SERVER": "http://host.docker.internal:8181",
     "DEFAULT_INFLUX_DATABASE": "mydb",
     "DEFAULT_API_TOKEN": "your-token-here",
     "DEFAULT_SERVER_NAME": "Local InfluxDB 3"
   }
   EOF
   ```

   Customize the following properties for your InfluxDB 3 instance:

   * **`DEFAULT_INFLUX_SERVER`**: your [InfluxDB 3 Core](/influxdb3/core/reference/config-options/#http-bind) or [Enterprise](/influxdb3/enterprise/reference/config-options/#http-bind) server URL
   * **`DEFAULT_INFLUX_DATABASE`**: the name of your [InfluxDB 3 Core](/influxdb3/core/admin/databases/) or [Enterprise](/influxdb3/enterprise/admin/databases/) database
   * **`DEFAULT_API_TOKEN`**: your [InfluxDB 3 Core](/influxdb3/core/admin/tokens/) or [Enterprise](/influxdb3/enterprise/admin/tokens/) authorization token with the necessary permissions to access your server
   * **`DEFAULT_SERVER_NAME`**: a display name (only used by Explorer) for your [InfluxDB 3 Core](/influxdb3/core/get-started/setup/#start-influxdb) or [Enterprise](/influxdb3/enterprise/get-started/setup/#start-influxdb) server

   > [!Note]
> #### When to use `host.docker.internal` ####
> If your InfluxDB 3 instance is running in Docker (not the same container as Explorer),
> use `host.docker.internal` as your server host to allow the Explorer container to
> connect to the InfluxDB container on the host–for example:
> ```
> "DEFAULT_INFLUX_SERVER": "http://host.docker.internal:8181"
> ```
> * If both Explorer and InfluxDB are in the same Docker network, use the container name instead.
> * If InfluxDB is running natively on your machine (not in Docker), use `localhost`.
> For more information, see the [Docker networking documentation](https://docs.docker.com/desktop/features/networking/).

   If your InfluxDB 3 instance is running in Docker (not the same container as Explorer),
   use `host.docker.internal` as your server host to allow the Explorer container to
   connect to the InfluxDB container on the host–for example:

   ```
   "DEFAULT_INFLUX_SERVER": "http://host.docker.internal:8181"
   ```

   * If both Explorer and InfluxDB are in the same Docker network, use the container name instead.
   * If InfluxDB is running natively on your machine (not in Docker), use `localhost`.

   For more information, see the [Docker networking documentation](https://docs.docker.com/desktop/features/networking/).

2. **Mount the configuration directory:**

   #### Docker ####

   ```
   docker run --detach \
     --name influxdb3-explorer \
     --publish 127.0.0.1:8888:8080 \
     --volume $(pwd)/config:/app-root/config:ro \
     influxdata/influxdb3-ui:1.8.0
   ```

   ```
   version: '3.8'

   services:
     explorer:
       image: influxdata/influxdb3-ui:1.8.0
       container_name: influxdb3-explorer
       ports:
         - "127.0.0.1:8888:8080"
       volumes:
         - ./config:/app-root/config:ro
       restart: unless-stopped
   ```

### Enable TLS/SSL (HTTPS)

To enable TLS/SSL for secure connections:

1. **Create SSL directory and add certificate files:**

   ```
   mkdir -m 755 ./ssl
   # Copy your certificate files to the ssl directory
   cp /path/to/server.crt ./ssl/
   cp /path/to/server.key ./ssl/
   ```

   Required files:

   * Certificate: `server.crt` or `fullchain.pem`
   * Private key: `server.key`

2. **Run the container with SSL enabled:**

   #### Docker ####

   ```
   docker run --detach \
     --name influxdb3-explorer \
     --publish 127.0.0.1:8888:8443 \
     --volume $(pwd)/ssl:/etc/nginx/ssl:ro \
     influxdata/influxdb3-ui:1.8.0
   ```

   ```
   version: '3.8'

   services:
     explorer:
       image: influxdata/influxdb3-ui:1.8.0
       container_name: influxdb3-explorer
       ports:
         - "127.0.0.1:8888:8443"
       volumes:
         - ./ssl:/etc/nginx/ssl:ro
       restart: unless-stopped
   ```

3. **Access the Explorer UI at [https://localhost:8888](https://localhost:8888)**

> [!Note]
> The nginx web server automatically detects and uses certificate files in the mounted path.

#### TLS and certificate verification options

Use the following environment variables to configure TLS and certificate verification:

* `NODE_EXTRA_CA_CERTS` - Path to custom CA certificate file inside container (recommended).

  This option adds an intermediate or custom CA certificate to the Node.js trusted certificate store
  and is required when InfluxDB uses certificates signed by an internal or private CA.

  * **Format**: PEM format certificate file
  * **Example**: `-e NODE_EXTRA_CA_CERTS=/ca-certs/ca-bundle.crt`

  > [!Note]
> This is the native Node.js environment variable for custom CAs.

* `CA_CERT_PATH` - Alternative to `NODE_EXTRA_CA_CERTS` (convenience alias)

  * **Example**: `-e CA_CERT_PATH=/ca-certs/ca-bundle.crt`

  > [!Note]
> Use either `NODE_EXTRA_CA_CERTS` or `CA_CERT_PATH`; not both. `CA_CERT_PATH` aliases `NODE_EXTRA_CA_CERTS`.

#### Use self-signed certificates

To configure Explorer to trust self-signed or custom CA certificates when connecting to InfluxDB:

1. **Create a directory for CA certificates:**

   ```
   mkdir -p ./ca-certs
   ```

2. **Copy your CA certificate to the directory:**

   ```
   cp /path/to/your-ca.pem ./ca-certs/
   ```

3. **Mount the CA certificate directory and set the `NODE_EXTRA_CA_CERTS` environment variable:**

[](#view-example-docker-configuration-for-self-signed-certificates)

View example Docker configuration for self-signed certificates

#### Docker ####

```bash
docker run --detach \
  --name influxdb3-explorer \
  --restart unless-stopped \
  --publish 127.0.0.1:8888:8443 \
  --volume $(pwd)/db:/db:rw \
  --volume $(pwd)/config:/app-root/config:ro \
  --volume $(pwd)/ssl:/etc/nginx/ssl:ro \
  --volume $(pwd)/ca-certs:/ca-certs:ro \
  --env SESSION_SECRET_KEY=your-secure-secret-key-here \
  --env NODE_EXTRA_CA_CERTS=/ca-certs/your-ca.pem \
  influxdata/influxdb3-ui:1.8.0 \
  --mode=admin
```

```yaml
# docker-compose.yml
version: '3.8'

services:
  explorer:
    image: influxdata/influxdb3-ui:1.8.0
    container_name: influxdb3-explorer
    pull_policy: always
    command: ["--mode=admin"]
    ports:
      - "127.0.0.1:8888:8443"
    volumes:
      - ./db:/db:rw
      - ./config:/app-root/config:ro
      - ./ssl:/etc/nginx/ssl:ro
      - ./ca-certs:/ca-certs:ro
    environment:
      SESSION_SECRET_KEY: ${SESSION_SECRET_KEY:-your-secure-secret-key-here}
      NODE_EXTRA_CA_CERTS: /ca-certs/your-ca.pem
    restart: unless-stopped
```

### Choose operational mode

InfluxDB 3 Explorer supports two operational modes:

* **Query mode** (default): Read-only UI for querying data
* **Admin mode**: Full UI with administrative capabilities

Set the mode using the `--mode` parameter:

#### Docker ####

```bash
# Query mode (default)
docker run --detach \
  --name influxdb3-explorer \
  --publish 127.0.0.1:8888:8080 \
  influxdata/influxdb3-ui:1.8.0 \
  --mode=query

# Admin mode
docker run --detach \
  --name influxdb3-explorer \
  --publish 127.0.0.1:8888:8080 \
  influxdata/influxdb3-ui:1.8.0 \
  --mode=admin
```

```yaml
version: '3.8'

services:
  explorer:
    image: influxdata/influxdb3-ui:1.8.0
    container_name: influxdb3-explorer
    # For query mode (default), omit the command
    # For admin mode, add:
    command: ["--mode=admin"]
    ports:
      - "127.0.0.1:8888:8080"
    restart: unless-stopped
```

## Advanced configuration

### Environment variables

|      Variable       |         Default         |                                            Description                                             |
|---------------------|-------------------------|----------------------------------------------------------------------------------------------------|
|`SESSION_SECRET_KEY` |       *(random)*        | Secret key for session management. **Set this in production to persist sessions across restarts.** |
|   `DATABASE_URL`    |     `/db/sqlite.db`     |                              Path to SQLite database inside container                              |
|   `SSL_CERT_PATH`   |`/etc/nginx/ssl/cert.pem`|                                    Path to SSL certificate file                                    |
|   `SSL_KEY_PATH`    |`/etc/nginx/ssl/key.pem` |                                    Path to SSL private key file                                    |
|`NODE_EXTRA_CA_CERTS`|        *(none)*         |Path to custom CA certificate file (PEM format) for trusting self-signed or internal CA certificates|
|   `CA_CERT_PATH`    |        *(none)*         |                                  Alias for `NODE_EXTRA_CA_CERTS`                                   |

> [!Important]
> Always set `SESSION_SECRET_KEY` in production to persist user sessions across container restarts.
> Enter the following command to generate a secure key:
> ```
> openssl rand -hex 32
> ```

```bash
openssl rand -hex 32
```

### Volume reference

|  Container Path  |        Purpose         |Permissions|            Required             |
|------------------|------------------------|-----------|---------------------------------|
|      `/db`       |SQLite database storage |    700    |      No (but recommended)       |
|`/app-root/config`|Connection configuration|    755    |               No                |
| `/etc/nginx/ssl` |  TLS/SSL certificates  |    755    |         Only for HTTPS          |
|   `/ca-certs`    | Custom CA certificates |    755    |Only for self-signed certificates|

### Port reference

|Container Port|Protocol|      Purpose       |Common Host Mapping|
|--------------|--------|--------------------|-------------------|
|     8080     |  HTTP  |Web UI (unencrypted)|       8888        |
|     8443     | HTTPS  | Web UI (encrypted) |       8888        |

## Complete examples

### Full configuration with all features

#### Docker ####

```bash
# Create required directories
mkdir -m 700 ./db
mkdir -m 755 ./config ./ssl

# Generate session secret
export SESSION_SECRET=$(openssl rand -hex 32)

# Create configuration
cat > config/config.json << 'EOF'
{
  "DEFAULT_INFLUX_SERVER": "http://host.docker.internal:8181",
  "DEFAULT_INFLUX_DATABASE": "production",
  "DEFAULT_API_TOKEN": "your-production-token",
  "DEFAULT_SERVER_NAME": "Production InfluxDB 3"
}
EOF

# Run Explorer with all features
docker run --detach \
  --name influxdb3-explorer \
  --pull always \
  --publish 127.0.0.1:8888:8443 \
  --volume $(pwd)/db:/db:rw \
  --volume $(pwd)/config:/app-root/config:ro \
  --volume $(pwd)/ssl:/etc/nginx/ssl:ro \
  --env SESSION_SECRET_KEY=$SESSION_SECRET \
  --restart unless-stopped \
  influxdata/influxdb3-ui:1.8.0 \
  --mode=admin
```

```yaml
# docker-compose.yml
version: '3.8'

services:
  explorer:
    image: influxdata/influxdb3-ui:1.8.0
    container_name: influxdb3-explorer
    pull_policy: always
    command: ["--mode=admin"]
    ports:
      - "127.0.0.1:8888:8443"
    volumes:
      - ./db:/db:rw
      - ./config:/app-root/config:ro
      - ./ssl:/etc/nginx/ssl:ro
    environment:
      SESSION_SECRET_KEY: ${SESSION_SECRET_KEY}
    restart: unless-stopped
```

Create a `.env` file that contains the following:

```bash
SESSION_SECRET_KEY=your_32_char_hex_string_here
```

Start the container:

```bash
docker-compose up -d
```

### Development setup (minimal)

#### Docker ####

```bash
docker run --rm \
  --name influxdb3-explorer \
  --publish 127.0.0.1:8888:8080 \
  influxdata/influxdb3-ui:1.8.0
```

```yaml
# docker-compose.yml
version: '3.8'

services:
  explorer:
    image: influxdata/influxdb3-ui:1.8.0
    container_name: influxdb3-explorer
    ports:
      - "127.0.0.1:8888:8080"
```
| Variable | Default | Description |
| --- | --- | --- |
| Variable | Default | Description |
| SESSION_SECRET_KEY | (random) | Secret key for session management.  Set this in production to persist sessions across restarts. |
| DATABASE_URL | /db/sqlite.db | Path to SQLite database inside container |
| SSL_CERT_PATH | /etc/nginx/ssl/cert.pem | Path to SSL certificate file |
| SSL_KEY_PATH | /etc/nginx/ssl/key.pem | Path to SSL private key file |
| NODE_EXTRA_CA_CERTS | (none) | Path to custom CA certificate file (PEM format) for trusting self-signed or internal CA certificates |
| CA_CERT_PATH | (none) | Alias for  NODE_EXTRA_CA_CERTS |

| Container Path | Purpose | Permissions | Required |
| --- | --- | --- | --- |
| Container Path | Purpose | Permissions | Required |
| /db | SQLite database storage | 700 | No (but recommended) |
| /app-root/config | Connection configuration | 755 | No |
| /etc/nginx/ssl | TLS/SSL certificates | 755 | Only for HTTPS |
| /ca-certs | Custom CA certificates | 755 | Only for self-signed certificates |

| Container Port | Protocol | Purpose | Common Host Mapping |
| --- | --- | --- | --- |
| Container Port | Protocol | Purpose | Common Host Mapping |
| 8080 | HTTP | Web UI (unencrypted) | 8888 |
| 8443 | HTTPS | Web UI (encrypted) | 8888 |