The fastest way to run QueryProxy is a single container. It needs no compose file and no external services.

docker run -d --name queryproxy \
  -p 7432:7432 \
  -v queryproxy-data:/var/www/html/storage/app \
  -e [email protected] \
  -e QUERYPROXY_ADMIN_PASSWORD='choose-a-strong-password' \
  queryproxy/queryproxy

Then open http://localhost:7432 and log in with that address.

Three processes run inside that one container:

Process	Role
Web portal	nginx + php-fpm, as a non-root user
Queue worker	Approved queries execute here
Scheduler	Housekeeping (result retention pruning, queue maintenance)

The first boot generates an application key, runs the migrations and creates a SQLite database. Everything that must survive a container replacement — that database, the generated key and the result files — lives on the single /var/www/html/storage/app volume.

Images are published for linux/amd64 and linux/arm64 on every release, to both Docker Hub (queryproxy/queryproxy) and the GitHub Container Registry (ghcr.io/queryproxy/queryproxy), as latest and per-version tags.

For production, set APP_KEY explicitly and keep it stable. It encrypts your stored connection credentials; if the volume is lost and the key regenerates, those credentials become unreadable. Generate one with docker run --rm queryproxy/queryproxy php artisan key:generate --show, pass it as -e APP_KEY=..., and rotate via APP_PREVIOUS_KEYS.

Your first account

QueryProxy has no public registration, and a fresh instance has no accounts. The QUERYPROXY_ADMIN_EMAIL / QUERYPROXY_ADMIN_PASSWORD variables above create the first administrator on boot. They are ignored once the instance has any user, so leaving them in place across restarts is harmless.

To create the account by hand instead — or to add another administrator later:

docker exec -it queryproxy php artisan queryproxy:create-admin

Demo accounts

Demo seeding is off by default. To explore with sample data, set QUERYPROXY_SEED_DEMO=true. That seeds a demo team with one account per role:

Role	Email
Admin	`[email protected]`
DBA	`[email protected]`
Developer	`[email protected]`
Auditor	`[email protected]`

All four share one randomly generated password, printed once in the container logs (docker logs queryproxy) — there is no fixed default password. For safety the seeder refuses to run while APP_ENV=production unless you also set QUERYPROXY_SEED_DEMO_FORCE=true.

Log in as each role to explore the product: the DBA creates connections and approves requests, the developer submits queries, the auditor reads the trail.

Prefer Compose?

The repository ships a docker-compose.yml with that same single service, plus commented blocks for running the worker as its own container or pointing the application database at MySQL/PostgreSQL:

git clone https://github.com/QueryProxy/QueryProxy.git
cd QueryProxy
docker compose up -d

First real request, end to end

As Admin, create a team and add your users with roles (Admin → Teams).
As DBA, add a database connection (Connections → New Connection) and use Test Connection to verify it. Grant it to your developers.
As Developer, open Query Studio, pick the connection, write a query and submit it.
As DBA, approve it from Approvals — the worker executes it and the requester gets the masked result.

Next steps

Installing without Docker? See Manual installation.
All environment variables: Configuration.
Approvals in chat: Slack integration.