Free tools Windows power users keep installed
One-click scans. No signup required.
The best VPS Docker stack is small and purpose-built, not a collection of every popular image. Start with the service that solves a specific problem, then leave enough CPU, memory, storage, backup capacity, and maintenance time for it. Vaultwarden and Uptime Kuma are sensible lightweight starters. Nextcloud, Jellyfin, Gitea, Paperless-ngx, n8n, and Home Assistant each fit a different job. Immich is an excellent photo platform, but its project documentation calls for at least 6 GB of RAM and 2 CPU cores, with 8 GB and 4 cores recommended, so it deserves separate capacity planning.
This guide explains what each application does, how demanding it is, which combinations fit on 4 GB or 8 GB VPS plans, and how to deploy and maintain a secure multi-container host in 2026.
As an Amazon Associate I earn from qualifying purchases.
If you want a VPS prepared for this workflow, Antihost Linux VPS plans include full root access and a one-click Docker image, so you can deploy your own Compose projects while keeping control of the host.
How to choose Docker apps for a VPS
Evaluate every candidate against the same eight questions before installing it:
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
- Outcome: What concrete task will the service perform?
- Compute profile: Does it use steady memory, burst CPU during indexing, or hardware acceleration?
- Persistent growth: How quickly will photos, videos, documents, repositories, or database records consume disk?
- Database burden: Does it require PostgreSQL, MariaDB, Redis, or another stateful dependency?
- Exposure: Must it be reachable from the public internet, or can it stay on a private network?
- Identity: Does it support multiple users, roles, single sign-on, or multi-factor authentication?
- Recovery: Can you back up and restore both its database and uploaded files?
- Connectivity: Does it need a route into your home network or access to a GPU?
This prevents the common mistake of treating a “best apps” list as a shopping list. A tiny monitoring service and a photo indexer may both run in containers, but their operational requirements are not remotely equivalent.
Quick comparison
| Application | Best for | Relative VPS profile | Storage pattern | Internet exposure |
|---|---|---|---|---|
| Nextcloud | Files, calendars, contacts, collaboration and office integration | Moderate; database and background jobs matter | Grows with user files and previews | Usually public through HTTPS |
| Immich | Google Photos-like personal photo and video library | High during uploads, machine learning and indexing | Large media library plus PostgreSQL data | Public or VPN-only, depending on use |
| Vaultwarden | Bitwarden-compatible password server | Lightweight for small households or teams | Small database, but critical data | Public HTTPS endpoint normally required for clients |
| Jellyfin | Streaming a personal media library | Variable; direct play is light, transcoding is expensive | Large and steadily growing media files | Public or private, depending on remote viewing |
| Uptime Kuma | Endpoint monitoring and notifications | Lightweight | Small status history database | Keep the dashboard restricted where possible |
| Gitea | Git repositories, issues and team workflows | Light to moderate, depending on repository activity | Repositories, attachments and database | Public or VPN-only |
| Paperless-ngx | OCR, tagging and searching personal documents | Moderate; OCR creates CPU bursts | Original files, OCR text and thumbnails | Prefer private access or tightly controlled HTTPS |
| n8n | API integrations, scheduled jobs and event-driven automation | Variable; executions can spike CPU and memory | Workflow definitions, execution history and credentials | Public only through a hardened reverse proxy |
| Home Assistant | Home and device automation | Light to moderate, depending on integrations | History database and configuration | Requires a secure path to the home network |
The best self-hosted Docker apps by job
Nextcloud: private files and collaboration
Choose Nextcloud when you need one private workspace for shared files, calendars, contacts, and collaboration features rather than a single-purpose file transfer tool. It is a broad platform, so the real cost is operational: a database, background jobs, previews, updates, and a growing user-file directory.
Use persistent storage for both the data directory and database. Schedule background jobs rather than relying on web requests for maintenance tasks, and watch disk usage because previews and versions can grow faster than expected. If several people will use it, plan account recovery, quota policy, and a tested restore procedure before importing data.
Immich: a personal photo and video library
Immich is the closest fit for readers who want a self-hosted, Google Photos-like experience with mobile uploads, search, albums, and video handling. It is not a “tiny container” workload. Immich’s 2026 Requirements documentation says, For a smooth experience, especially during asset upload, Immich requires at least 6GB of RAM.
The same documentation lists a baseline of 6 GB RAM and 2 CPU cores, with 8 GB RAM and 4 cores recommended.
Use local SSD storage for Immich’s PostgreSQL data; the project documentation specifically advises against placing that database on a network share. Keep the original media on storage with enough free space for the library, thumbnails, machine-learning artifacts, and temporary upload work. Uploads and indexing create bursts, so a plan that appears adequate while idle can still stall during an import.
Immich’s production guidance recommends Docker Compose. The usual process is to download the project’s Compose file and environment template, set the required values, create persistent volume locations, and start the stack with docker compose up -d. Pin the deployment files you use and read release notes before upgrades because the application, workers, and database must remain compatible.
Vaultwarden: lightweight password management
Vaultwarden provides a Bitwarden-compatible server that suits a small VPS stack. Its resource footprint is usually modest, but its data is exceptionally sensitive. Treat the database and attachment directory as critical records: use HTTPS, a strong unique administrative secret, restrictive firewall rules, and backups stored away from the VPS.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallDo not expose a database port or administrative interface directly to the internet. Test account recovery and a full restore before trusting the service with your only copy of passwords. A lightweight service is not a low-consequence service.
Jellyfin: self-hosted media streaming
Jellyfin is a good choice when you own the media and want your own catalog, clients, and streaming control. Resource requirements depend on what viewers play. Direct-play files may use little CPU, while transcoding high-resolution or incompatible codecs can saturate a small VPS.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Before choosing a plan, list the codecs your clients support and estimate the maximum number of simultaneous remote viewers. If transcoding is unavoidable, account for CPU headroom or compatible hardware acceleration; otherwise, design for direct play and keep the media directory on fast, expandable storage. Back up the configuration and metadata separately from the large media collection so a rebuild does not require copying every video again.
Uptime Kuma: monitor the rest of the stack
Uptime Kuma is a small status and alerting service that can watch HTTPS endpoints, TCP ports, and other health checks. It is an ideal companion for a VPS because it can notify you when a reverse proxy, application, certificate, or home-network tunnel fails.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Monitoring from the same host has a blind spot: a completely failed VPS cannot report its own outage. Where the service is important, place a second monitor outside the machine or use an external notification path. Keep the dashboard private and monitor disk space, memory pressure, certificate expiry, and application-specific health endpoints.
Gitea: compact Git hosting
Gitea offers repositories, issues, pull requests, and team workflows without the footprint of a large enterprise forge. It fits private projects well when you accept responsibility for updates, access control, and backups.
Back up repositories and the database, not just the container volume. A repository backup that cannot be restored with its users, permissions, issues, and release attachments is incomplete. Restrict registration, require strong authentication, and decide whether repositories should be reachable only through a VPN.
Paperless-ngx: searchable document management
Paperless-ngx imports scans and PDFs, runs OCR, and lets you organize records with tags and correspondents. OCR and thumbnail generation create CPU bursts, especially when importing an archive, so avoid starting a large migration on a memory-constrained host.
Recommended Free Tools
Define retention before importing documents. Preserve the original files, OCR output, application database, and any consume-directory content in your backup plan. Since these may include identity or financial records, private-network access is preferable unless public access is genuinely necessary.
n8n: API and scheduled automation
n8n connects APIs, webhooks, and scheduled jobs. It can replace many small SaaS automations, but workflows often contain tokens that can create, delete, or move data. Keep credentials out of Compose files and public repositories; use an environment file excluded from version control or a secrets mechanism.
Expose n8n only through a reverse proxy with HTTPS and strong authentication. Limit webhook routes, review execution-history retention, and set resource limits so a runaway workflow cannot starve your other containers.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Home Assistant: automation with a home-network dependency
Home Assistant is useful on a VPS only when the machine has a secure, reliable path to the home environment and the operator is comfortable maintaining that connection. A VPN or similarly controlled tunnel is safer than opening device protocols to the public internet.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Expect extra troubleshooting: a VPS outage, tunnel failure, changing home IP address, or local device discovery problem can all look like an application failure. Keep the configuration and history database backed up, and avoid granting the VPS broader access to the home LAN than the integrations require.
VPS sizing: 2 GB, 4 GB or 8 GB?
Use these as planning bands, not guarantees. Actual consumption is dominated by indexing, OCR, transcoding, concurrent users, database size, and bursty jobs.
| VPS size | Reasonable starting use | What to avoid | Planning notes |
|---|---|---|---|
| 2 GB RAM | A very small utility stack such as Vaultwarden, Uptime Kuma, a reverse proxy, and one low-traffic service | Immich, heavy OCR, multiple databases, or concurrent transcoding | Leave room for the operating system, Docker, updates and backup jobs |
| 4 GB RAM | Light services, a small Gitea or Paperless-ngx deployment, or Nextcloud with modest use | Immich combined with machine learning or other bursty workloads; large concurrent imports | A current sizing guide describes Vaultwarden, Nextcloud and Uptime Kuma as a light combination, but warns against pairing Immich with machine learning or Plausible on 4 GB unless Immich is the only major workload |
| 8 GB RAM or more | A safer starting point for Immich, Nextcloud with several users, or multiple databases and workers | Assuming unlimited media growth or transcoding capacity | Immich documentation recommends 8 GB RAM and 4 CPU cores; storage and backup capacity still need separate planning |
Start with the heaviest service, then add headroom for its database, reverse proxy, monitoring, backups, and scheduled jobs. A 4-core host with insufficient disk or no recovery plan is not a reliable upgrade from a 2-core host.
Stacks that fit common requirements
Minimal secure starter
For a first VPS, combine a reverse proxy, Vaultwarden, and Uptime Kuma. This gives you a useful password service and visibility into failures without committing the machine to large media or indexing workloads. Keep backups off-host and use the monitor to alert on the public endpoints.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Private collaboration stack
Pair Nextcloud with Uptime Kuma and a reverse proxy when shared files, calendars, and contacts are the priority. Add Gitea only if you need Git workflows. Allocate extra disk for user files and previews, and schedule database and file backups before inviting additional users.
Photo-focused stack
Run Immich as the principal workload on an 8 GB-or-larger plan with at least 4 CPU cores, local SSD database storage, and media capacity sized to the library. Add Uptime Kuma and a reverse proxy, but avoid placing several other memory-hungry services on the same host until real usage data proves there is headroom.
Media server stack
Use Jellyfin with a reverse proxy and monitoring when your clients can direct-play most files. If remote users require transcoding, reserve CPU capacity for that job or move transcoding to hardware designed for it. Do not measure suitability by container idle memory alone.
Documents and automation stack
Paperless-ngx and n8n can coexist for a small household or team, but both can create bursts: OCR during imports and workflow executions during schedules or webhook floods. Isolate them on separate Compose projects, cap concurrency where available, and monitor memory before adding more services.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
A maintainable Docker Compose layout
Organize each application as its own Compose project instead of putting the entire VPS in one giant file. A practical directory pattern is:
/srv/apps/<app-name>/compose.yaml
/srv/apps/<app-name>/.env
/srv/apps/<app-name>/data/
/srv/apps/<app-name>/backups/Keep the Compose file in version control, but exclude .env, private keys, tokens, and database dumps. Use named volumes or deliberately chosen bind mounts, document ownership and permissions, and add explicit restart policies. Give each project only the networks it needs; a database should not share a public-facing network without a reason.
Deployment sequence
- Prepare the host: Apply operating-system updates, create a non-root administrator, configure a firewall, and install Docker from its supported repository.
- Create one project directory: Store the Compose file, private environment file, data mounts, and a short README describing ports, volumes, backup commands, and upgrade notes.
- Set secrets: Generate unique passwords and application keys. Never commit them to a public repository or paste them into a published tutorial.
- Define private networking: Put databases and internal workers on an internal Compose network. Publish only the reverse proxy and services that are intentionally public.
- Start and inspect: Run
docker compose up -d, then checkdocker compose psanddocker compose logs --tail=100for failed health checks, permission errors, or missing variables. - Terminate HTTPS at the proxy: Point DNS at the VPS, obtain certificates, redirect HTTP to HTTPS, and keep administrative ports off the public interface.
- Verify persistence: Recreate the containers and confirm that users, settings, and uploaded files remain. A service that works only until the next container replacement is not deployed correctly.
- Test recovery: Restore a database and a sample file set on a separate location before treating the installation as production-ready.
Security and maintenance checklist
- Patch the host, Docker components, operating-system packages, and application images on a controlled schedule.
- Pin image tags or record the exact versions you deploy; read release notes before upgrades.
- Use HTTPS, strong unique secrets, and multi-factor authentication wherever the application supports it.
- Never publish database ports, the Docker socket, or an unprotected administration port.
- Separate high-risk public applications from internal-only services with firewall rules and Compose networks.
- Monitor memory, disk utilization, certificate expiry, container health, and backup-job success.
- Back up databases and uploaded files off the VPS. Keep more than one recovery point and perform restore drills.
- Review users, API tokens, webhook URLs, and workflow credentials after staff or household access changes.
Backups, storage and restore planning
Container images are replaceable; application state is not. For each service, identify its database, uploads, configuration, secrets, generated indexes, and attachments. Back up the pieces required to recreate a working service, not merely the directory that happens to be mounted.
Use a schedule that matches the data. Password databases and active documents may need frequent backups; a media library may use a slower incremental schedule if originals exist elsewhere. Store copies outside the VPS and encrypt sensitive archives. Keep enough historical versions to recover from accidental deletion or corruption.
A restore drill should answer four questions: Can you obtain a clean host? Can you retrieve the secrets safely? Can you restore the database and files in the right order? Can users sign in and open representative records afterward? Until those answers are tested, “backed up” is only an assumption.
Common failure modes and fixes
The VPS runs out of memory
Check container statistics and host swap activity, then identify the workload causing the spike. Pause imports, OCR, machine-learning jobs, or workflow executions; reduce concurrency; and move the heaviest service to a larger plan. Do not treat swap as a substitute for the RAM Immich or a transcoding workload actually requires.
Disk usage grows unexpectedly
Inspect media originals, thumbnails, previews, database files, logs, and backup archives separately. Set retention policies, rotate logs, remove abandoned volumes only after verifying their contents, and expand storage before the filesystem reaches 100 percent.
The application works locally but not through the domain
Verify DNS, firewall rules, reverse-proxy routing, certificate status, and the container’s published network. Keep the application’s internal port private and make sure the proxy forwards the correct protocol and host name.
An upgrade breaks the service
Stop and read the release notes, restore the previous image tag if necessary, and recover the database and files from a known-good backup. Keep a record of the last working Compose file and environment values so rollback is reproducible.
Jellyfin playback buffers
Determine whether the client is direct-playing or transcoding. Inspect the codec, resolution, bitrate, and number of concurrent sessions. Improve client compatibility or provide adequate CPU or hardware acceleration rather than adding unrelated containers.
Home Assistant loses devices
Check the VPN or tunnel first, then home routing, DNS, and device discovery. A VPS cannot discover local devices reliably without a deliberate network path; exposing broad home-network ports is not an acceptable shortcut.
What to self-host instead of SaaS
Self-hosting is most compelling when you need control over data location, retention, integrations, or long-term access and are willing to operate the system. Nextcloud can replace a general private file workspace; Immich can replace a hosted personal photo library; Vaultwarden can centralize passwords; Jellyfin can organize owned media; Gitea can host private code; Paperless-ngx can index records; and n8n can replace many API automations.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsThe trade is responsibility. You become the person who patches the host, renews certificates, monitors failures, pays for storage and bandwidth, protects credentials, and proves that backups restore. If you cannot perform those tasks, a smaller managed service may be safer than an ambitious VPS bundle.
Recommended starting decision
Pick one primary workload and one operational companion. For light use, that might be Vaultwarden plus Uptime Kuma. For collaboration, choose Nextcloud plus monitoring. For photos, dedicate an appropriately sized host to Immich before adding unrelated services. Add Jellyfin, Gitea, Paperless-ngx, n8n, or Home Assistant only when you can state its storage, exposure, backup, and recovery requirements.
Frequently Asked Questions
Can Immich, Nextcloud, Jellyfin and Vaultwarden run on one VPS?
They can, but not safely by default. Immich alone has a documented baseline of 6 GB RAM and 2 CPU cores, with 8 GB and 4 cores recommended. Add database, transcoding, indexing, reverse-proxy, and backup headroom, and test the combined workload before moving important data.
What is the lightest useful Docker stack for a small VPS?
A reverse proxy, Vaultwarden, and Uptime Kuma are a sensible starting combination. Keep databases and administration private, use HTTPS, and store backups off the VPS.
Recommended Free Tools
Should Docker databases use network storage?
For Immich, the project documentation recommends local SSD storage for PostgreSQL rather than a network share. Apply the same caution to other databases unless their documentation explicitly supports the storage design.
How often should self-hosted Docker apps be updated?
Use a controlled schedule rather than blind automatic updates: check release notes, back up state, update one Compose project, inspect logs and health checks, and keep the previous image tag available for rollback.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
