Install ClickHouse on a Linux VPS with the package format that matches your distribution, keep the server’s data directory on persistent storage, and verify it locally before opening a port. Debian and Ubuntu users can use the official DEB repository; RHEL-family systems can use the RPM repository; TGZ or a single binary suits unsupported repository layouts; and Docker works well when its ports, volumes and file-descriptor limit are configured deliberately. The procedure below takes you from installation through a durable table, remote-access choices and a security checklist.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What you need before installing ClickHouse
ClickHouse is a column-oriented analytical database. A VPS is a suitable host when you need a continuously running service, predictable storage and control over the operating system. Use a persistent server installation for data you intend to keep. clickhouse-local is an exploration tool: it runs queries against local files or temporary tables and is not a replacement for clickhouse-server when data must survive a process exit or reboot.
As an Amazon Associate I earn from qualifying purchases.
- A 64-bit Linux VPS with enough memory, CPU and disk for your schema, indexes, merges and retention period. No universal VPS size guarantees a particular throughput; benchmark your workload on the storage and instance size you plan to run.
- Persistent storage for
/var/lib/clickhouse(or the equivalent Docker volume). Keep free space available for parts, merges and future growth. - Administrative access through
sudo, plus a firewall you control at the VPS or cloud level. - A plan for backups, monitoring and upgrades before loading important data.
Check the distribution first:
cat /etc/os-release
uname -mThe official supported-platform list includes Linux x86_64 DEB, RPM and TGZ builds for self-managed installations when they are installed according to the ClickHouse Install Reference Guide. Package versions change frequently. On October 13, 2026, the official repository listed stable 26.9.18.11 and LTS 26.8.26.12; check the repository immediately before a production rollout rather than pinning these numbers indefinitely.
Choose an installation method
| Method | Best fit | Service integration | Upgrade and filesystem considerations | Isolation |
|---|---|---|---|---|
| DEB packages | Debian or Ubuntu VPS | Native systemd/service tooling | Package manager handles files; upgrades follow the configured repository channel | Runs directly on the host |
| RPM packages | RHEL, CentOS, Fedora or Amazon Linux | Native systemd tooling | Uses yum/dnf repository management and host filesystem ownership | Runs directly on the host |
| TGZ archive | A distribution where DEB/RPM repositories are unsuitable | You must create and maintain service integration | You choose the install directory and upgrade procedure | Runs directly on the host |
| Single binary | Quick experiments or custom layouts | No service is created automatically | You manage the binary, data paths and upgrades | Runs directly on the host |
| Docker | Teams already operating containers | Container lifecycle rather than host packages | Volumes must be mapped and image upgrades staged; ownership follows the image/container setup | Process and dependency isolation, but storage and networking remain your responsibility |
For a conventional single-node VPS, native packages are usually the simplest to operate. Choose Docker when your backup, deployment and monitoring workflows are already container-based and you are comfortable managing volume permissions, port publishing and container limits.
Install ClickHouse on Debian or Ubuntu
1. Add the official DEB repository
Run these commands as a sudo-capable user. The key URL and repository syntax are maintained by the official ClickHouse package repository; verify them against the repository page if its channel layout changes.
sudo apt-get update
sudo apt-get install -y apt-transport-https ca-certificates curl gnupg
curl -fsSL 'https://packages.clickhouse.com/rpm/lts/repodata/repomd.xml.key'
| sudo gpg --dearmor -o /usr/share/keyrings/clickhouse-keyring.gpg
ARCH=$(dpkg --print-architecture)
echo "deb [signed-by=/usr/share/keyrings/clickhouse-keyring.gpg arch=${ARCH}] https://packages.clickhouse.com/deb stable main"
| sudo tee /etc/apt/sources.list.d/clickhouse.list
sudo apt-get updateThe ARCH variable makes APT use the architecture reported by your system. Do not copy a repository channel from an old tutorial without checking which stable or LTS channel is currently published.
2. Install the server and client
sudo apt-get install -y clickhouse-server clickhouse-client
sudo service clickhouse-server start
sudo systemctl enable clickhouse-serverThe package may ask configuration questions during installation. Record any password or access choice you make, then inspect the service before changing network bindings.
3. Check status and logs
sudo systemctl status clickhouse-server --no-pager
sudo journalctl -u clickhouse-server -n 100 --no-pagerA failed start is commonly caused by a malformed configuration, a permissions problem on the data directory or another process already using a required port. Fix the first error shown in the service log, restart the service and check status again.
Install on RHEL-family distributions
RHEL, CentOS, Fedora and Amazon Linux use the RPM repository path. The repository page currently publishes the following setup; use dnf in place of yum where that is the normal package manager on your release.
sudo yum install -y yum-utils
sudo yum-config-manager --add-repo https://packages.clickhouse.com/rpm/clickhouse.repo
sudo yum install -y clickhouse-server clickhouse-client
sudo systemctl enable clickhouse-server
sudo systemctl start clickhouse-serverConfirm the repository’s current channel and package versions at https://packages.clickhouse.com/rpm/clickhouse.repo before production deployment. Then verify the unit and recent messages:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
sudo systemctl status clickhouse-server --no-pager
sudo journalctl -u clickhouse-server -n 100 --no-pagerSELinux policy, host firewalls and custom mount points can affect a service even when installation succeeds. Keep the initial listener private while you resolve those host-level details.
Use a TGZ archive or single binary
The official repository provides TGZ archives for systems where DEB or RPM packages are unsuitable. A TGZ installation gives you control over the binary and directory layout, but you must supply the service definition, user ownership, log rotation and upgrade process yourself. Treat the data directory and configuration as production state, not as files in a temporary extraction directory.
For a quick local experiment, the OSS quick start also supports:
curl https://clickhouse.com/ | shThat command downloads a single clickhouse binary into the current directory. It is useful for trying SQL and file formats, but clickhouse-local tables are temporary. On a VPS, run clickhouse-server with a persistent data path and a supervised service if the data must remain available after logout or reboot.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallVerify the installation with a durable table
1. Connect locally first
clickhouse-clientStarting with a local connection keeps the HTTP and native interfaces off the public internet while you establish authentication and firewall rules. Inside the client, confirm the server responds:
SELECT version();2. Create a database and MergeTree table
Run this complete smoke test. It creates durable server-side objects, inserts two rows and aggregates them:
CREATE DATABASE IF NOT EXISTS analytics;
CREATE TABLE IF NOT EXISTS analytics.events
(
event_time DateTime,
user_id UInt64,
event_type LowCardinality(String),
value Float64
)
ENGINE = MergeTree
ORDER BY (event_type, event_time);
INSERT INTO analytics.events VALUES
('2026-10-15 07:00:00', 1, 'signup', 1.0),
('2026-10-15 07:01:00', 2, 'purchase', 49.99);
SELECT event_type, count(), sum(value)
FROM analytics.events
GROUP BY event_type
ORDER BY event_type;The final query should return one row for purchase and one for signup, with counts of one and sums of 49.99 and 1.0 respectively. The MergeTree engine writes data to the server’s data directory and is the normal starting point for single-node analytical tables. The ORDER BY expression is part of the table’s physical design; choose it for the filters and ranges your application actually uses.
3. Confirm restart persistence
sudo systemctl restart clickhouse-server
clickhouse-client --query "SELECT count() FROM analytics.events"A count of 2 after restart confirms that you tested the server’s persistent path rather than an in-memory or local-only session.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Run ClickHouse with Docker
Launch a persistent container
The official clickhouse/clickhouse-server image exposes HTTP on port 8123 and the native client protocol on port 9000. This example binds both ports only to localhost, maps data and logs to the host, and applies the file-descriptor limit recommended by the image documentation:
docker run -d --name clickhouse-server
--ulimit nofile=262144:262144
-p 127.0.0.1:8123:8123
-p 127.0.0.1:9000:9000
-v "$PWD/ch_data:/var/lib/clickhouse"
-v "$PWD/ch_logs:/var/log/clickhouse-server"
clickhouse/clickhouse-server/var/lib/clickhouse is the main data directory and /var/log/clickhouse-server is the log directory in the image. Back up the host directories, not just the writable container layer. Ensure the Docker user can read and write the mapped directories; a container that starts with an empty or unwritable mount can look healthy while failing to create useful data.
Initialize a named user and database
The image supports the CLICKHOUSE_DB, CLICKHOUSE_USER, CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT=1 and CLICKHOUSE_PASSWORD environment variables for first-run initialization. Supply these at container creation time, store the password in your secret-management system and avoid putting it in shell history or a public compose file.
The image documentation notes that the default user has network access disabled when none of those setup credentials or related access-management options are set. That behavior is safer than exposing an unauthenticated default account, but it does not replace creating a least-privilege application user.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Publish ports only after hardening
Keep the 127.0.0.1 bindings during setup. Change them to a reachable address only after authentication is configured and firewall rules restrict the source networks. A binding of 0.0.0.0 makes the service reachable on every VPS interface; it is not a security control.
Ports and client protocols
| Interface | Port | Typical use | Exposure decision |
|---|---|---|---|
| HTTP | 8123 | SQL over HTTP, scripts and clients that speak the HTTP API | Keep private unless an authenticated application or controlled proxy needs it |
| Native protocol | 9000 | clickhouse-client and drivers using ClickHouse’s native protocol |
Allow only from application or administration networks |
Choose HTTP when your application already sends SQL over HTTP or requires its ecosystem. Choose the native protocol for native drivers and clickhouse-client. The two ports provide different client surfaces, so opening one does not make the other unnecessary. Restrict both at the VPS firewall and, where available, at the cloud security-group layer.
Secure a VPS before remote access
Create a named, least-privilege account
Do not publish the default account. Create a named user for each application or operator, assign only the databases and operations it needs, and use a unique high-entropy secret. Keep administrative credentials separate from ingestion credentials. Test the account locally before allowing its source address through the firewall.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesLimit network sources
- Permit port 9000 only from application servers, a VPN or a tightly controlled administration network.
- Permit port 8123 only when an HTTP client genuinely needs it, and restrict it to the same trusted sources.
- Leave all other ClickHouse listeners and management interfaces inaccessible from the public internet unless you have a documented, authenticated use for them.
- Use the VPS provider’s network firewall as a second boundary, not as a substitute for host rules.
Protect secrets and configuration
Store passwords outside source control, shell history and world-readable environment files. Review the ClickHouse configuration and file permissions after package installation, especially if you copied settings from another host. If traffic crosses an untrusted network, deploy an authenticated encrypted transport arrangement appropriate to your environment rather than sending credentials over an exposed plaintext path.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Persistence, backups and routine operations
Data and logs
Keep /var/lib/clickhouse on persistent storage and preserve logs separately so a full data volume does not erase the evidence needed to diagnose it. In Docker, map both directories as shown above. On a package installation, confirm the actual paths in the host configuration before writing backup jobs.
Backups and restores
Back up databases and configuration on a schedule that matches the value of the data, copy backups off the VPS, and test a restore onto an isolated server. A backup that has never been restored is an assumption, not a recovery plan. Include the credentials and firewall steps needed to make a restored instance usable, but do not place live secrets in the backup repository.
Monitor the signals that predict failure
- Disk free space and inode availability, including growth of detached or temporary files.
- Memory and CPU pressure, especially during background merges.
- Merge activity and query latency, not just process uptime.
- Service restarts, error logs and failed authentication attempts.
Before loading important data, reboot the VPS (or recreate the container), verify that the service starts automatically, run the smoke-test query and perform a documented restore test.
Upgrades without surprises
ClickHouse package channels change as new stable and LTS releases are published. Pin or stage upgrades instead of applying every update directly to the production node. Read the release notes and repository metadata, test the upgrade against a copy of your schema and data, take a verified backup, then monitor merges and query latency after the change.
Native packages generally integrate upgrades with the host’s package manager and systemd. TGZ and single-binary installations require you to replace binaries and maintain service definitions yourself. Docker upgrades mean pulling a new image, stopping and recreating the container while retaining the same data volume, and checking image-specific initialization behavior. In every model, preserve the data directory and keep a rollback plan that matches the version and storage format you actually deployed.
Troubleshooting common first-install failures
The service will not start
Read systemctl status and the last 100 journal lines first. Correct configuration syntax, ownership and mount-point errors before changing ports. If another process occupies a listener, identify it and either stop the conflicting service or choose a deliberate, documented port arrangement.
The client cannot connect locally
Confirm that clickhouse-server is running, that you are using the matching clickhouse-client package, and that local firewall rules are not blocking the socket or port. A successful package installation does not prove that the service completed startup.
Free tools Windows power users keep installed
One-click scans. No signup required.
Remote connections time out
Check all three layers: ClickHouse’s listening configuration, the VPS host firewall and the cloud security group. Verify that the client is using HTTP 8123 or native 9000 as intended. A localhost-only binding such as 127.0.0.1:9000 will intentionally reject remote traffic until you change it.
A Docker container loses data after recreation
Inspect docker inspect clickhouse-server and confirm that /var/lib/clickhouse maps to a persistent host directory or named volume. Data written only to the container’s writable layer disappears when that container is removed.
Queries fail after the disk fills
Stop ingestion if necessary, free or extend storage, and inspect logs before deleting files. Do not manually remove ClickHouse data parts to make space; use documented retention, backup and table-maintenance procedures so metadata remains consistent.
A practical go-live checklist
- The installation method matches the VPS distribution and the repository channel was checked recently.
clickhouse-serverstarts after reboot (or the container restarts with its volumes intact).SELECT version()succeeds locally.- A database,
MergeTreetable, insert and groupedSELECThave all completed. - The row count remains correct after a restart.
- Data and logs are on persistent storage with tested off-host backups.
- A named least-privilege user has a strong secret; the default account is not a public endpoint.
- Ports 8123 and 9000 are private or restricted to known source addresses.
- Disk, memory, CPU, merges, latency and logs are monitored.
- Upgrade, rollback and restore procedures have been rehearsed on a non-production copy.
Once these checks pass, point your application at the protocol it supports, keep the firewall narrow and benchmark your own schema and queries. Installation determines whether ClickHouse runs; storage design, access controls and operational testing determine whether the VPS remains dependable.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
