This is the most useful thing you can do with a Droplet. One server running Docker can host your file sync, automation, monitoring, bookmarks, and password vault for the price of a single SaaS subscription. It's also the setup with the sharpest edges — including one firewall behaviour that regularly exposes people's databases to the open internet.
A $12–24/mo Droplet will comfortably run several self-hosted apps that would cost far more as subscriptions. You need to be comfortable with the command line and Docker Compose, and you need to read the firewall section below carefully — Docker publishes ports by writing its own iptables rules, which bypass UFW. People discover this when their database ends up publicly reachable.
Memory is the binding constraint, not CPU. Rough guide to how much you can stack on one box:
| Droplet | Price | Realistically runs |
|---|---|---|
| 1 GB / 1 vCPU | $6/mo | One or two light apps — Uptime Kuma, a link shortener, a small bot |
| 2 GB / 1 vCPU | $12/mo | Three or four apps, or one that includes a database |
| 4 GB / 2 vCPUs | $24/mo | Nextcloud plus Postgres, n8n, monitoring, a reverse proxy — a real personal stack |
| 8 GB / 4 vCPUs | $48/mo | A dozen services, or anything doing media transcoding |
Add a swap file whichever size you pick — Droplets don't have one by default, and swap turns "the kernel killed my database" into "things got slow for a minute". Add 20% for weekly backups on top of these prices.
| Component | Purpose |
|---|---|
| Docker Engine (CE) | The container runtime, already running as a service. |
| Docker Compose | Defines multi-container stacks in a single YAML file. This is what you'll actually use. |
| Docker BuildX | Extended build features, including multi-architecture images. |
That's deliberately all it includes — no reverse proxy, no TLS, no firewall configuration. Those are the parts you add.
Create a Droplet from the Marketplace Docker 1-Click image with an SSH key. Verify with docker version and docker compose version once you're in.
Docker manipulates iptables directly when you publish a port. A container started with -p 5432:5432 is reachable from the internet even if UFW says that port is closed, because Docker's rules are evaluated first. This is documented behaviour, not a bug, and it catches almost everyone.
Two things fix it. First, use DigitalOcean's cloud firewall, configured in the control panel — it sits outside the Droplet, so Docker can't write around it. Second, bind services to localhost in your Compose file (127.0.0.1:5432:5432) so only the reverse proxy and other containers can reach them.
Put your stack in a docker-compose.yml. Use named volumes for anything that must survive a container being recreated — databases, uploads, config. Data written inside a container without a volume disappears when the container is replaced, which is how people lose things.
Run Caddy or Traefik as a container in front of everything. Both request and renew Let's Encrypt certificates automatically, so each app gets a proper subdomain over HTTPS without you touching certbot. Point a wildcard DNS record at the Droplet and add services as you go.
Droplet backups capture the whole disk and are worth enabling. But for databases, a filesystem snapshot of a running database can be inconsistent — add a scheduled pg_dump or mysqldump into a volume, and copy those dumps off the server.
Nextcloud replaces Dropbox and Google Drive. Wants 2 GB minimum with its database, more if several people use it. The heaviest thing on this list.
n8n replaces Zapier, and self-hosting removes per-task pricing entirely. Modest resource needs unless your workflows are heavy.
Uptime Kuma watches your other services and alerts you. Very light, and the natural answer to "nobody tells me when my site goes down".
Vaultwarden is a lightweight Bitwarden-compatible server. Tiny footprint. Think hard about backups before trusting it with your passwords.
Plausible or Umami give you privacy-friendly site analytics without sending visitor data to a third party.
FreshRSS or Wallabag for feeds and read-later. Light enough to run alongside anything else here.
docker compose pull then up -d.docker system prune is a habit worth having.Yes, if you're comfortable in a terminal, you're replacing several subscriptions, and you find running your own infrastructure interesting rather than tedious. The economics are genuinely good: a $24 Droplet can displace well over $50/mo of SaaS.
No, if you'd be storing something you can't afford to lose without a tested backup routine, or you want this to be zero-maintenance. Self-hosting is a hobby with running costs in attention as well as money. That's fine if you want the hobby, and a poor trade if you don't.
Almost certainly not. Kubernetes solves problems of scale and orchestration across many machines. For a handful of apps on one server, Compose is simpler, cheaper, and easier to debug at midnight.
Because Docker inserts its own iptables rules ahead of UFW's chain when it publishes a port. Use DigitalOcean's cloud firewall, and bind sensitive services to 127.0.0.1. This is the single most important thing on this page.
Yes, and it's a reasonable way to run several sites on one Droplet. If you want one WordPress site with less setup, the 1-Click WordPress image is the faster route.
docker compose pull && docker compose up -d on a schedule you actually keep. Tools like Watchtower can automate it, though automatic updates to a database container are a good way to find out whether your backups work.
Containers start failing in confusing ways. Run docker system prune periodically, and attach a Block Storage volume if you're genuinely storing a lot — it's cheaper per GB than resizing the whole Droplet.
A self-hosting box from $12/mo
Docker Engine and Compose pre-installed. One Droplet, as many apps as it'll hold.
Get started with DigitalOceanAffiliate link — we may earn a commission at no extra cost to you.