A VPS for Docker and self-hosting

How much server do your containers need?

Containers share the host kernel, so the overhead is small. What counts is the sum of what each app uses, with databases usually the largest part. Add up the RAM, then keep 20 to 30 percent free for spikes and the system.

• Developer (1 vCPU, 2 GB, 30 GB NVMe): a reverse proxy plus two or three light apps, such as a status page, a small analytics tool or a personal wiki.
• Production (2 vCPU, 4 GB, 60 GB NVMe): a typical self-hosting box, for example a Git service, an automation tool and a password manager, each with its database.
• Performance (4 vCPU, 8 GB, 120 GB NVMe): ten or more containers, heavier databases, or image builds on the server.
• Enterprise (8 vCPU, 16 GB, 240 GB NVMe): CI runners, search engines, many services, or a small team's whole toolset. Includes IPv6.

Images and volumes take disk space quickly. Run docker system df now and then, and docker image prune to clean up.

Install Docker Engine and Compose on Ubuntu 24.04

1. Remove old packagesUbuntu's own docker.io or podman-docker packages can conflict. Remove them with apt remove if they are installed.
2. Add Docker's repositoryapt install ca-certificates curl, create /etc/apt/keyrings, download https://download.docker.com/linux/ubuntu/gpg to /etc/apt/keyrings/docker.asc, and add a sources entry for download.docker.com/linux/ubuntu with your release codename (noble for 24.04) signed by that key.
3. Install the packagesapt update, then apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin.
4. Check it worksdocker run hello-world, then docker compose version. Compose v2 is the docker compose plugin, with a space, not the old docker-compose binary.
5. Optional: run without sudousermod -aG docker youruser and log in again. Note that the docker group is effectively root access, so only add users you trust.
6. Start your stackPut a compose.yaml in a project folder, keep secrets in a .env next to it, and run docker compose up -d. Use restart: unless-stopped so containers come back after a reboot.

Put a reverse proxy in front

Instead of publishing every app on its own port, run one reverse proxy container (Caddy, Traefik or Nginx Proxy Manager) on ports 80 and 443. It gets free TLS certificates from Let's Encrypt and routes app.yourdomain.com to the right container over an internal Docker network.

Point an A record for each subdomain to your VPS's IPv4 address. On Enterprise and above you can add AAAA records for IPv6 too.

Firewall and backups: the two things people forget

• Docker writes its own iptables rules, so a port published with ports: "8080:8080" is reachable from the internet even if ufw denies it. Publish internal apps on 127.0.0.1 only ("127.0.0.1:8080:8080") or not at all, and let the reverse proxy reach them over the Docker network.
• Keep ufw for the host: allow SSH, 80 and 443, deny the rest.
• Your data lives in volumes and bind mounts. Back it up yourself: dump databases with their own tools (pg_dump, mysqldump), then copy the dumps and volume folders off the server with a tool such as restic or borg.
• Pin image versions in compose.yaml instead of latest, read release notes, then docker compose pull && docker compose up -d to update.

Docker on an EclipsiumX VPS

Every VPS gives you root over SSH, a browser console in the VPS panel, NVMe storage and your own IPv4 address, in data centres in Germany. Choose Ubuntu 24.04 LTS or another system from the current list when you order, create your EclipsiumX account and pay on checkout. Billing is monthly from €4.99. The VPS is unmanaged, so the containers, updates and backups are in your hands.