Publishing, checked 2026-09-07

Directus: Docker configuration reference

Self-hosted headless CMS and instant REST/GraphQL API layer over an existing SQL database.

At a glance

Ports

Ports
PortWhat listensSource
8055HTTP listener for the API and the Data Studio app. Route the proxy here.source for port 8055

Environment variables

Environment variables
VariableRequiredWhat it doesExampleSource
PUBLIC_URLNoURL where the API is reached on the web. Used for OAuth redirects, forgot-password emails and publicly-accessible logos, and must be a qualified URL to use licensing or SSO.https://cms.example.comsource for PUBLIC_URL
SECRETNoSecret string used for signing. Defaults to a random value if unset, so set it explicitly to keep sessions valid across redeploys.openssl rand -hex 32source for SECRET
DB_CLIENTYesDatabase client. One of pg, mysql, oracledb, mssql, sqlite3 or cockroachdb.pgsource for DB_CLIENT
ADMIN_EMAILNoEmail of the first admin user, created automatically when the project bootstraps.admin@example.comsource for ADMIN_EMAIL
LICENSE_KEYNoLicense key activated against the Directus licensing service. Since v12.0.0, an instance without one runs on the Core tier and loses SSO and custom permission rules after a grace period.DXXXX-XXXXX-XXXXX-XXXXX-XXXXCsource for LICENSE_KEY

Volumes that must persist

Volumes
PathWhat is in itSource
/directus/uploadsUploaded files stored on local disk when no S3-compatible storage adapter is configured.source for /directus/uploads

Behind a reverse proxy

Release timeline

Releases
VersionDateBreakingWhat changedSource
v12.3.12026-08-25NoAdded emitter listener-count methods and fixed a WebSocket heartbeat listener leak and GraphQL fragments returning null fields.source for release v12.3.1
v12.3.02026-08-18YesFixed leaking storage connections that could make every asset request return a permission error until restart, and changed pm2 invocation in the Docker image's entrypoint.source for release v12.3.0
v12.2.02026-07-29YesRestricted minimal app access to fewer settings fields and replaced the TinyMCE WYSIWYG editor with Tiptap, which can lock existing content read-only pending confirmation.source for release v12.2.0
v12.1.12026-07-01NoDependency bump only, updating vite to 8.1.2.source for release v12.1.1
v12.1.02026-07-01YesRemoved the /utils/hash/generate and /utils/hash/verify endpoints and limited sensitive system mutations to single use.source for release v12.1.0

If it is not coming up

Read from the upstream documentation, repository and container registry by Keita Emsden on 2026-09-07. Every row links the page it came from. Upstream changes without telling anyone, so check the source link before you rely on a value.

Other app references

All app references