Community Quick Start

Community Quick Start

Use this page to run Chat2DB Community locally with Docker. Community is a single-user, local-first application. Direct exposure to other users, a LAN, or the Internet is unsupported.

Requirements

• Docker 19.03 or later
• Docker Compose 1.25 or later
• 2 or more CPU cores
• 4 GiB or more memory

Start with Docker Compose

git clone https://github.com/OtterMind/Chat2DB.git
cd Chat2DB

./script/security/init-community-encryption-key.sh
docker compose --file docker/docker-compose.yml up --detach

Open:

http://127.0.0.1:10825

Check the container and follow its logs:

docker compose --file docker/docker-compose.yml ps
docker compose --file docker/docker-compose.yml logs --follow

Start with Docker directly

./script/security/init-community-encryption-key.sh

docker run --detach \
  --name chat2db-community \
  --restart unless-stopped \
  --publish 127.0.0.1:10825:10825 \
  --volume "$HOME/.chat2db-community-docker:/root/.chat2db-community" \
  --env CHAT2DB_COMMUNITY_ENCRYPTION_KEY_FILE=/run/secrets/chat2db-community-encryption.key \
  --volume "$HOME/.config/chat2db-community/encryption.key:/run/secrets/chat2db-community-encryption.key:ro" \
  chat2db/chat2db:latest

Follow the logs:

docker logs --follow chat2db-community

Back up both data and key material

Back up both of these paths:

• $HOME/.chat2db-community-docker
• $HOME/.config/chat2db-community/encryption.key

Community encrypts datasource passwords and user-supplied AI model API keys with the installation key. Replacing or losing the key makes existing encrypted values unrecoverable. Non-Desktop runtimes fail at startup when no valid key is available; they do not silently create a replacement key.

Update

Back up the data directory and encryption key first. Pull the new image, stop and remove the old container, and start a new container with the same data directory and the same key.

Never generate a new key over an existing installation during an update.

Security boundary

• Keep the host binding as 127.0.0.1:10825:10825. Do not publish the service on every network interface.
• Custom JDBC drivers are executable Java code. Install drivers only from trusted sources.
• Imported files, SQL, database content, and AI responses remain untrusted input.
• Report vulnerabilities through GitHub private vulnerability reporting, not a public issue.

The repository README and Security Policy are authoritative for current Community startup and security requirements.