Self-Hosted Apps You Can Run on a VPS with Docker

Applies to: Linux VPS or dedicated server with Docker Engine and the Compose plugin (Compose files checked with Docker CLI 29.9.0 and Compose v5.6.0); image ports and versions read from the registries

Self-hosted apps are programs you run on your own server instead of paying for a hosted service: file sync, photo backup, password vaults, automation, uptime checks and more. Most popular projects publish an official Docker image and a Compose file, so on a Linux VPS the install is usually: create a folder, save a compose.yaml, run docker compose up -d, then put HTTPS in front. Below are well-known open-source and source-available apps, grouped by what they replace, with each project's licence and official install method. The list is in no particular order.

Before you start

• Docker and Compose: install Docker Engine with the Compose plugin from Docker's repository, see how to install Docker on Debian and Ubuntu and Docker Compose basics.
• Firewall: according to Docker's documentation, traffic to a published container port is diverted before it reaches ufw, so a ufw rule does not protect it. Publish ports as 127.0.0.1:PORT:PORT and let a reverse proxy (Nginx, Caddy or Traefik) serve the app over HTTPS.
• Resources: check each project's requirements before you pick a plan. Immich, for example, asks for at least 6 GB of RAM and 2 CPU cores (8 GB and 4 cores recommended) in its documentation.
• Backups and updates: your data lives in the volumes or folders listed in the Compose file. Back them up, and update with docker compose pull followed by docker compose up -d.

Files and sync

• Nextcloud (AGPL-3.0): file storage, sync and sharing on your own server, with optional extras such as Nextcloud Office and Talk. The project calls Nextcloud All-in-One (AIO) its official installation method: one "mastercontainer" whose web interface runs on port 8080 and which then creates and updates the other containers. It is given read-only access to the Docker socket for that. Our older guide shows Nextcloud with Docker.
• Syncthing (MPL-2.0): continuous file synchronisation between your devices and the server, without a central cloud. The image exposes 8384 (web GUI) and 22000 TCP and UDP (sync). See how to run Syncthing in Docker.

Photos, video and media

• Immich (AGPL-3.0): photo and video backup from your phone, with albums, sharing and search by faces and objects. The official install downloads docker-compose.yml and example.env (saved as .env) from the latest release. In our check, that file defines four services (server, machine learning, Redis-compatible Valkey and PostgreSQL) and publishes port 2283. Its README asks you to keep a 3-2-1 backup of your photos.
• Jellyfin (GPL-2.0): a media server that streams your own films, series and music to browsers, TVs and apps. Web interface on port 8096. See how to install Jellyfin on a VPS.

Passwords

• Vaultwarden (AGPL-3.0): a lightweight server, written in Rust, that is compatible with the official Bitwarden clients. Its README states that it is not associated with Bitwarden, Inc. The web vault only works over HTTPS, so plan the reverse proxy first. The README's Compose example publishes it on 127.0.0.1:8000 and stores data in ./vw-data.

Automation and AI

• n8n (Sustainable Use License): workflow automation with a visual editor and hundreds of integrations. The project calls itself "fair-code". Its licence allows use for your own internal business purposes or for non-commercial or personal use, and you may provide it to others only free of charge for non-commercial purposes. Port 5678. See how to install n8n with Docker Compose and HTTPS.
• Open WebUI (Open WebUI License): a chat interface for Ollama and OpenAI-compatible APIs. Its licence is BSD-style with an added branding clause: deployments with more than 50 users in 30 days may not remove the "Open WebUI" branding without permission or an enterprise licence. Port 8080. See how to install Open WebUI with Docker.

Monitoring and analytics

• Uptime Kuma (MIT): checks websites, ports, ping and DNS and sends alerts through many notification services, with public status pages. The official compose.yaml uses the image louislam/uptime-kuma:2, port 3001 and a ./data folder. Run it on a different server from the sites it watches.
• Matomo (GPL-3.0): web analytics where the visitor data stays on your server. See self-hosted web analytics with Matomo.

Code, documents and container management

• Gitea (MIT): Git hosting with code review, issues, a wiki, a package registry and CI/CD that can reuse GitHub Actions, according to its README. The official image exposes port 3000 (web) and 22 (Git over SSH); map SSH to another host port if the server's own SSH uses 22.
• Paperless-ngx (GPL-3.0): turns scanned paper documents into a searchable archive. The README recommends Docker Compose and offers an install script that writes the Compose setup for you; read the script before running it. Port 8000.
• Portainer CE (zlib licence): a web interface for managing Docker containers, images and volumes (the web interface on port 9443, according to Portainer's documentation). See using Portainer to manage Docker.

How to run any of these with Docker Compose

1. Create one folder per app, for example mkdir -p ~/apps/uptime-kuma && cd ~/apps/uptime-kuma.
2. Save the project's official compose.yaml there (copy it from the project's README or release page, not from a random blog). Change the published port to 127.0.0.1:PORT:PORT.
3. Check the file before you start anything. docker compose config prints the final configuration and stops on errors. Lab output for the Vaultwarden example, then for a file with one wrong indent:

   $ docker compose config
   ...
       ports:
         - mode: ingress
           host_ip: 127.0.0.1
           target: 80
           published: "8000"
           protocol: tcp
   
   $ docker compose -f bad.yaml config --quiet
   go-yaml load error in parser (while parsing a block mapping) at L2.C3-L4.C4: did not find expected key

   host_ip: 127.0.0.1 confirms the app is reachable only from the server itself.
4. Start it: docker compose up -d, and watch the first start with docker compose logs -f (see Docker Compose logs).
5. Add a site to your reverse proxy that forwards your domain to 127.0.0.1:PORT, with a Let's Encrypt certificate. Our n8n behind Nginx guide shows the pattern; only the port changes.
6. Back up the data folders and the Compose file, and test a restore once.

Open source or source-available?

Most apps above use an open-source licence (MIT, MPL, GPL, AGPL, zlib). The AGPL (Nextcloud, Immich, Vaultwarden) adds one rule that matters for servers: if you modify the code and let other people use it over a network, you must offer them your modified source. n8n and Open WebUI use their own licences with extra conditions, quoted above. Read the licence before you offer any app to customers.

Any of these runs on a Ucartz KVM VPS with full root access. For apps such as n8n, Portainer and Matomo, our team does a free basic setup on request through a Technical Support ticket.

Official documentation: Docker and ufw, Nextcloud AIO, Immich, Vaultwarden and Uptime Kuma.