Skip to main content

Self-hosted Retool requirements

Learn about the requirements for Self-hosted Retool.

Deploying Self-hosted Retool on your own infrastructure lets you build applications with data in your virtual private cloud (VPC) or behind your virtual private network (VPN). Businesses in the healthcare and finance industries often deploy Retool to remain compliant.

You can self-host Retool on a variety of platforms using a Docker image provided by Retool. The available deployment methods vary in complexity and scalability, so you should choose an option that lets you get started quickly, is provisioned appropriately, and sets you up for long-term success.

Choose between a single VM deployment or an orchestrated container deployment method based on your background and use case.

note

If you're evaluating a large production use case or need Enterprise plan features, book a demo to learn more.

Single VM deployments​

Use a Docker Compose-based method to deploy Retool if you and your team:

  • Are currently evaluating Retool or deploying Retool for the first time
  • Have less experience with Docker or DevOps concepts
  • Need a lightweight, low cost, and low maintenance deployment method
  • Want to deploy Retool on a small-scale or single-server environment

Orchestrated deployments​

More complex and scalable deployment methods, such as Kubernetes or Elastic Container Service (ECS), might be appropriate if you and your team:

  • Already use the chosen deployment method
  • Have experience with Docker or DevOps concepts
  • Require scalability, high availability, and resilience

Hardware requirements​

Resource requirements vary depending on your usage.

Single VM deployments​

Retool images run on Linux machines using x86 processors—arm64 is not supported. You must ensure the VM meets the following recommended requirements:

  • Ubuntu 22.04 or later.
  • 16GiB memory.
  • 8x vCPUs.
  • 60GiB storage.
  • curl and unzip software packages installed.

The 60 GiB of storage is required to support the PostgreSQL container included by default in Retool's deployment configuration files.

Orchestrated deployments​

When deploying Retool using container orchestration tools such as Kubernetes, your cluster should contain at least one node that matches the specifications above. Refer to deployment guides and your provider's documentation for more detail.

Storage database​

By default, many of the deployment guides include a containerized instance of PostgreSQL alongside Retool, but it is possible and recommended to externalize the database to support a stateless deployment.

The minimum recommended version for the PostgreSQL database is version 13. Your PostgreSQL database must also enable the uuid-ossp module and use the Read Committed isolation level.

Network requirements​

Changes to Retool IP addresses (December 2022)

The following IP address information recently changed. If your Self-hosted Retool deployment makes use of outbound firewall rules, ensure they are up-to-date. Learn more about Retool's IP address changes.

Retool Self-hosted organizations must ensure that their deployments allow access to Retool's IP addresses or domains. If you make use of outbound firewall rules, include the following IP addresses or domains in its allowlist. These allow your deployment to connect to Retool's license check, user authentication, and usage reporting services.

CIDR IP addresses
35.92.202.168/29
44.211.178.248/29
Individual IP addresses
35.92.202.168
35.92.202.169
35.92.202.170
35.92.202.171
35.92.202.172
35.92.202.173
35.92.202.174
35.92.202.175
44.211.178.248
44.211.178.249
44.211.178.250
44.211.178.251
44.211.178.252
44.211.178.253
44.211.178.254
44.211.178.255
Domains
licensing.tryretool.com
invites.tryretool.com
email-service.retool.com
p.tryretool.com
specs.tryretool.com

Test the connection​

You can test your changes within Retool to make sure your deployment can reach the new IP addresses:

  1. Sign in to Retool and navigate to the Query Library.
  2. Click + New to create a new query.
  3. Select the REST resource and GET action type.
  4. Set the URL to https://reachability-test.retool.com.
  5. Click Save to save the query, then click ▶ to run the query.
  6. If the query returns a 200 status and OK status text, your deployment can successfully reach the new IP addresses.

Query to test the connection

HTTP proxy connections​

Retool supports connections to the internet through a HTTP proxy. Add HTTP_PROXY=http://example.com:8080 to your deployment's docker.env file with the required URL and port number.

License checks​

Retool uses HTTP to connect to licensing.tryretool.com on port 443 to verify your license. License checks are made at least once a day.

Inviting users​

Retool connects to invites.tryretool.com and email-service.retool.com on port 443 when inviting users. Retool verifies the users are authorized under your current billing plan, and then sends an invite to their email address.

Usage reporting​

Retool sends application usage information to p.tryretool.com on port 443, which is used to inform product decisions.

Usage categories​

The categories of usage information sent to Retool includes, but is not limited to, the following:

  • Page views, along with the page URL.
  • Query saves, including the query name and type.
  • Component creation and the component type.
  • Query preview, including the query name and type.
  • Adding a resource, including the resource name and type.

Events are also sent with the hostname, public IP address, browser user-agent string, and the user's email address.

Retool AI​

Disable Retool AI for your deployment

You can disable Retool AI from Settings > Beta.

Self-hosted customers running Retool 3.14 or later can deploy and embed Retool AI within applications and workflows. When a user performs any action with Retool AI, the input is shared with the applicable third-party LLM provider, listed in our Subprocessors page. Inputs are deleted within 30 days.

You can configure a direct connection to a supported AI platform by providing an API key. You also have the option to use a Retool-managed OpenAI connection. If enabled, AI requests are proxied through Retool The Retool-managed OpenAI connection is disabled by default. Contact your Retool account representative or our support team to gain access.

For production use cases, we recommend you provide an API key and directly connect to an AI platform.

When Retool AI is used to build or configure a query, application, or workflow (e.g., prompting Ask AI to help write queries), any inputs or outputs that correspond to the categories above may continue to be used to inform product improvements. Retool does not use any inputs submitted to, or outputs generated from, Retool AI that is embedded within a deployed application or workflow (e.g., text stored in Retool Vectors). These inputs and outputs are treated as "Customer Data" in according with the Customer Terms of Service, Security Practices, and Data Processing Addendum.