We may earn a commission if you sign up through links on this site, at no extra cost to you. Full disclosure.

Self-Host Apps with Docker on DigitalOcean

This is the most useful thing you can do with a Droplet. One server running Docker can host your file sync, automation, monitoring, bookmarks, and password vault for the price of a single SaaS subscription. It's also the setup with the sharpest edges — including one firewall behaviour that regularly exposes people's databases to the open internet.

The short version

A $12–24/mo Droplet will comfortably run several self-hosted apps that would cost far more as subscriptions. You need to be comfortable with the command line and Docker Compose, and you need to read the firewall section below carefully — Docker publishes ports by writing its own iptables rules, which bypass UFW. People discover this when their database ends up publicly reachable.

Sizing your Droplet

Memory is the binding constraint, not CPU. Rough guide to how much you can stack on one box:

DropletPriceRealistically runs
1 GB / 1 vCPU$6/moOne or two light apps — Uptime Kuma, a link shortener, a small bot
2 GB / 1 vCPU$12/moThree or four apps, or one that includes a database
4 GB / 2 vCPUs$24/moNextcloud plus Postgres, n8n, monitoring, a reverse proxy — a real personal stack
8 GB / 4 vCPUs$48/moA dozen services, or anything doing media transcoding

Add a swap file whichever size you pick — Droplets don't have one by default, and swap turns "the kernel killed my database" into "things got slow for a minute". Add 20% for weekly backups on top of these prices.

What's in the 1-Click image

ComponentPurpose
Docker Engine (CE)The container runtime, already running as a service.
Docker ComposeDefines multi-container stacks in a single YAML file. This is what you'll actually use.
Docker BuildXExtended build features, including multi-architecture images.

That's deliberately all it includes — no reverse proxy, no TLS, no firewall configuration. Those are the parts you add.

Setting it up

1. Deploy the Docker image

Create a Droplet from the Marketplace Docker 1-Click image with an SSH key. Verify with docker version and docker compose version once you're in.

2. Set up the firewall properly — read this one

Docker manipulates iptables directly when you publish a port. A container started with -p 5432:5432 is reachable from the internet even if UFW says that port is closed, because Docker's rules are evaluated first. This is documented behaviour, not a bug, and it catches almost everyone.

Two things fix it. First, use DigitalOcean's cloud firewall, configured in the control panel — it sits outside the Droplet, so Docker can't write around it. Second, bind services to localhost in your Compose file (127.0.0.1:5432:5432) so only the reverse proxy and other containers can reach them.

3. Write a Compose file

Put your stack in a docker-compose.yml. Use named volumes for anything that must survive a container being recreated — databases, uploads, config. Data written inside a container without a volume disappears when the container is replaced, which is how people lose things.

4. Add a reverse proxy for HTTPS

Run Caddy or Traefik as a container in front of everything. Both request and renew Let's Encrypt certificates automatically, so each app gets a proper subdomain over HTTPS without you touching certbot. Point a wildcard DNS record at the Droplet and add services as you go.

5. Back up volumes, not just the Droplet

Droplet backups capture the whole disk and are worth enabling. But for databases, a filesystem snapshot of a running database can be inconsistent — add a scheduled pg_dump or mysqldump into a volume, and copy those dumps off the server.

Apps worth running

Files and sync

Nextcloud replaces Dropbox and Google Drive. Wants 2 GB minimum with its database, more if several people use it. The heaviest thing on this list.

Automation

n8n replaces Zapier, and self-hosting removes per-task pricing entirely. Modest resource needs unless your workflows are heavy.

Monitoring

Uptime Kuma watches your other services and alerts you. Very light, and the natural answer to "nobody tells me when my site goes down".

Passwords

Vaultwarden is a lightweight Bitwarden-compatible server. Tiny footprint. Think hard about backups before trusting it with your passwords.

Analytics

Plausible or Umami give you privacy-friendly site analytics without sending visitor data to a third party.

Reading

FreshRSS or Wallabag for feeds and read-later. Light enough to run alongside anything else here.

What you're taking on

What Docker makes easier

  • Apps are isolated, so one broken service doesn't take down the others.
  • Updating is usually docker compose pull then up -d.
  • Rolling back means running the previous image tag.
  • The whole stack is described in one file you can keep in version control.

What's still on you

  • Host OS patching. Containers don't update Ubuntu.
  • Updating images yourself — nothing auto-updates, and stale images accumulate known vulnerabilities.
  • Understanding the iptables behaviour above. This is a real security responsibility.
  • Disk management. Old images and volumes fill a disk quietly; docker system prune is a habit worth having.
  • Backups and, more importantly, testing that a restore actually works.

Is this right for you?

Yes, if you're comfortable in a terminal, you're replacing several subscriptions, and you find running your own infrastructure interesting rather than tedious. The economics are genuinely good: a $24 Droplet can displace well over $50/mo of SaaS.

No, if you'd be storing something you can't afford to lose without a tested backup routine, or you want this to be zero-maintenance. Self-hosting is a hobby with running costs in attention as well as money. That's fine if you want the hobby, and a poor trade if you don't.

FAQ

Do I need Kubernetes instead?

Almost certainly not. Kubernetes solves problems of scale and orchestration across many machines. For a handful of apps on one server, Compose is simpler, cheaper, and easier to debug at midnight.

Why did my UFW rules not block a container port?

Because Docker inserts its own iptables rules ahead of UFW's chain when it publishes a port. Use DigitalOcean's cloud firewall, and bind sensitive services to 127.0.0.1. This is the single most important thing on this page.

Can I run WordPress in Docker here too?

Yes, and it's a reasonable way to run several sites on one Droplet. If you want one WordPress site with less setup, the 1-Click WordPress image is the faster route.

How do I keep images updated?

docker compose pull && docker compose up -d on a schedule you actually keep. Tools like Watchtower can automate it, though automatic updates to a database container are a good way to find out whether your backups work.

What happens when I run out of disk?

Containers start failing in confusing ways. Run docker system prune periodically, and attach a Block Storage volume if you're genuinely storing a lot — it's cheaper per GB than resizing the whole Droplet.

A self-hosting box from $12/mo

Docker Engine and Compose pre-installed. One Droplet, as many apps as it'll hold.

Get started with DigitalOcean

Affiliate link — we may earn a commission at no extra cost to you.

← All DigitalOcean guides