VPS for Docker

Docker is the reason most people rent their first VPS. Not because they need one big application, but because they want five small ones — an app, a database, a cache, a reverse proxy, some tool they read about — living together on a machine they control, coming back automatically after a reboot.

That's a $8 box.

What you get

A clean Linux image (Ubuntu 24.04, Debian 12, or AlmaLinux 9), full root, and nothing preinstalled — no control panel eating RAM, no vendor agent, no surprises. Small ($8/mo — 4 vCPU, 4 GB RAM, 35 GB NVMe) is the size most stacks settle on.

Storage is real NVMe in RAID1, which matters more than people think once you have a database and a container writing logs at the same time.

The five minutes

# Ubuntu 24.04
apt update && apt upgrade -y
apt install -y docker.io docker-compose-v2
systemctl enable --now docker

docker run hello-world   # sanity check

A typical stack:

# /opt/stack/docker-compose.yml
services:
  app:
    image: your/app:latest
    restart: always
    depends_on: [ db ]

  db:
    image: postgres:16
    restart: always
    environment:
      POSTGRES_PASSWORD: change_me
    volumes: [ ./pgdata:/var/lib/postgresql/data ]

  caddy:                      # HTTPS, automatically
    image: caddy:2
    restart: always
    ports: [ "80:80", "443:443" ]
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - caddy_data:/data

volumes:
  caddy_data:

cd /opt/stack && docker compose up -d

restart: always is what makes this survive a reboot. Caddy handles Let's Encrypt certificates on its own once your domain points at the server.

One important note: anything serving web traffic needs a dedicated-IP plan (from $8/mo). Our NAT plans give you a shared IP with a forwarded SSH port — great for bots, workers, and agents that only make outbound connections; not suitable for hosting a site.

Before you expose anything

ufw allow OpenSSH
ufw allow 80,443/tcp
ufw enable

Docker publishes ports directly through iptables, which surprises people — a container with ports: ["5432:5432"] is reachable from the internet even with a firewall you thought was closed. Bind internal services to 127.0.0.1 and only publish what genuinely needs to be public. Our security checklist covers the rest.

Why here

Crypto, no KYC. Email to sign up, USDC or USDT to pay. No card, no documents, no verification queue — and at $8/month, a box you can throw away when the project ends. New to crypto?

Unmetered traffic on 1 Gbit/s. Pulling images and shipping logs won't produce a surprise bill.

Picking a plan

Related reading

• Secure a new VPS: a checklist
• Self-host n8n — a Docker stack worth having

Ready? Deploy a Docker host → — clean image, full root, live in about a minute.