You can self-host a code quality server on one Linux VPS with Docker, but a reliable installation needs more than starting a container. Prepare the host for embedded Elasticsearch, use persistent volumes, move production data to an external database, terminate HTTPS at a reverse proxy, restrict access, and plan backups and upgrades. Community Build is the practical starting point for a personal project or small team; commercial editions are licensed by instance and maximum lines of code, while Data Center is designed for clustered resiliency rather than a low-cost single VPS.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Choose the edition before provisioning the VPS
Your edition determines language coverage, security features, licensing, support expectations, and whether a single-node deployment is appropriate. Decide this first so you do not size a server around an edition you cannot legally or operationally use.
As an Amazon Associate I earn from qualifying purchases.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchCommunity Build
Community Build is the self-managed free offering and is released monthly. Its stated core coverage includes code bugs, code smells, and basic security analysis across 21 programming languages and frameworks. It is the sensible baseline for a personal installation, a learning environment, or a small team that can work within its feature and language limits.
Developer edition
Developer is a commercial single-instance edition with broader language and DevOps coverage. The documented examples include Java, Python, C#, JavaScript, TypeScript, Docker, Kubernetes and Helm, Terraform, and YAML. It is a better fit when pull-request analysis, additional security capabilities, or languages outside Community Build are required.
Enterprise edition
Enterprise adds further commercial capabilities and language coverage. The higher-tier language list includes Apex, COBOL, Gosu, JCL, MuleSoft DataWeave, PL/I, RPG, and VB6, in addition to the broad coverage available in lower tiers.
Data Center edition
Data Center is intended for clustered resiliency. Its deployment uses separate datacenter-search and datacenter-app containers rather than the simple single-container pattern in this guide. A small VPS normally cannot provide the redundancy, capacity, and operational separation that this edition is designed for.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →| Edition | Coverage and purpose | Scale model | Licensing and operations |
|---|---|---|---|
| Community Build | Core bug, code-smell, and basic security analysis; 21 stated languages and frameworks | Single node | Free self-managed offering; monthly releases |
| Developer | Broader language, security, and DevOps capabilities, including common infrastructure-as-code formats | Single node | Commercial license based on instance and maximum LOC |
| Enterprise | Additional commercial capabilities and specialized languages such as COBOL, PL/I, RPG, and VB6 | Single node unless separately architected | Commercial license based on instance and maximum LOC |
| Data Center | Cluster-oriented deployment for resiliency | Multiple application and search components | Highest operational complexity; commercial licensing |
Commercial licenses are priced per instance per year and by the maximum lines of code (LOC) that instance may analyze. Licensing is per installation, not per user. The platform supports more than 30 languages and frameworks overall, but the exact list, limits, and terms can change, so verify the current edition documentation before purchase.
Size and prepare the Linux VPS
There is no single VPS size that is correct for every workload. Analysis volume, repository size, concurrent jobs, retention settings, and the selected edition determine CPU, memory, and storage needs. Treat the values below as host prerequisites, not as a capacity recommendation.
Use a supported Linux host and Docker
- Provision a current, supported 64-bit Linux distribution with Docker Engine and the Compose or equivalent container-management tooling you will use.
- Assign a stable public address or DNS name if scanners and administrators will reach the instance from the internet.
- Reserve fast persistent storage. The server stores indexes, uploaded analysis data, logs, and extensions, and Elasticsearch performance degrades when the disk is full or heavily contended.
- Keep operating-system updates, Docker, and the reverse proxy under a separate maintenance schedule from server upgrades.
Apply the Elasticsearch host settings
The server embeds Elasticsearch, so the Docker host must satisfy Elasticsearch production-mode and file-descriptor requirements. The documented Linux example is:
sysctl -w vm.max_map_count=524288
sysctl -w fs.file-max=131072
ulimit -n 131072
ulimit -u 8192These commands change the running host or shell. Persist the kernel values in the distribution’s sysctl configuration and make sure the service or container manager receives the required file and process limits after reboot. Confirm the current release documentation before deployment because requirements can change.
Check capacity before accepting builds
- Memory: leave headroom for the operating system, Docker, the web process, background computation, and Elasticsearch. A VPS that runs out of memory can appear healthy until an analysis or index operation starts.
- CPU: concurrent scanner jobs and large projects increase queue time. Limit CI concurrency before buying a larger server if demand is bursty.
- Disk: monitor the data volume, logs, extensions, Docker layers, and database storage independently. Retention and frequent branch analysis can consume space faster than expected.
- Network: scanners upload reports and download rule or analyzer updates. A private network link to the database is preferable when the provider offers one.
Create isolated persistent volumes
Never keep production data only in the writable container layer. Create separate volumes for the three paths used by the image:
/opt/quality-server/datafor application data and search indexes/opt/quality-server/logsfor logs needed during diagnosis/opt/quality-server/extensionsfor installed plugins and extensions
The same volumes must not be mounted by multiple server instances. Sharing them can corrupt indexes and application state. Back up these paths using a method that produces a restorable copy rather than merely copying files while the application is changing them.
Beginning with Server 2026.1, processes also need read/write access to /tmp/ for Java Attach API socket files used during Elasticsearch 8.x initialization. Do not mount a read-only temporary directory or apply a container policy that blocks those socket files.
Run the official Docker image
The official image is the shortest deployment path for one VPS. Use the image matching the edition you selected: quality-server:community for Community Build, or the corresponding commercial image such as quality-server:developer or quality-server:enterprise when you have a valid license.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsPull and pin an image
Do not build production operations around the moving latest tag. Select a current or long-term-support release, test it, and record the exact tag (or digest) in your deployment configuration. Keep the selected value in one environment variable so upgrades are an intentional change:
export QUALITY_SERVER_IMAGE='quality-server:community'For production, set that variable to the exact tested release tag published for your chosen edition, then pull it before starting the service:
docker pull "$QUALITY_SERVER_IMAGE"The example variable uses the Community image name so the command is runnable for an initial evaluation. Replace it with the tested release tag before declaring the instance production-ready.
Start a single-node container
Create the volumes and start the container with the documented listening port:
Free tools Windows power users keep installed
One-click scans. No signup required.
docker volume create quality_data
docker volume create quality_logs
docker volume create quality_extensions
docker run -d
--name quality-server
--stop-timeout 3600
-p 9000:9000
-v quality_data:/opt/quality-server/data
-v quality_logs:/opt/quality-server/logs
-v quality_extensions:/opt/quality-server/extensions
"$QUALITY_SERVER_IMAGE"Port 9000 is the documented container port. During an initial test, the interface is reachable at http://host-ip:9000. Do not expose that direct HTTP endpoint publicly once the service contains source-code metadata or administrator accounts.
Watch startup and health
- Run
docker logs -f quality-serverand wait for the web process and Elasticsearch to finish initialization. - Check
docker psand confirm the container remains running instead of restarting. - Open the interface locally or through a temporary firewall rule and complete the initial administrator setup.
- Inspect disk, memory, and log growth before connecting a busy CI pipeline.
A restart loop commonly indicates an unmet host limit, insufficient memory, a permissions problem on a volume, or a database connection error. Fix the underlying condition rather than repeatedly recreating the container.
Use an external database for production
The Docker image uses an embedded H2 database by default, and that database is not suited for production. Install a supported external database, preferably on a private network or protected database service, and configure the server with credentials supplied through secrets rather than committing passwords to shell history or a repository.
Why H2 is only for evaluation
- It is intended for quick trials, not durable production operation.
- Database recovery, maintenance, and backup workflows are weaker than those of a dedicated production database.
- Keeping application state in H2 makes migration and scaling decisions harder later.
Database design rules
- Use encrypted connections where the database supports them and validate the server certificate.
- Give the account only the permissions it needs to create and maintain its schema.
- Back up the database on a schedule separate from the Docker volume backup.
- Test restoring a backup into an isolated environment; a backup that has never been restored is only an assumption.
- Only one server or Community Build instance or cluster may connect to a database schema at a time. Concurrent use can corrupt data.
Configure the database connection using the image’s documented environment variables or configuration files for your release. Keep those values outside the image and rotate credentials through your secret-management process. Confirm supported database engines and versions in the release documentation before provisioning one.
Recommended Free Tools
Put HTTPS, authentication, and firewall controls in front
Use a maintained reverse proxy to terminate TLS and forward requests to the container on an internal interface. Obtain a certificate for the DNS name, redirect HTTP to HTTPS, and renew the certificate automatically. The proxy should be the only public entry point.
Minimum network policy
- Allow TCP 443 from intended administrators and scanner networks.
- Allow TCP 80 only when it is required for certificate issuance or HTTP-to-HTTPS redirection.
- Block public access to host port 9000, or bind it only to a private interface used by the proxy.
- Restrict database traffic to the server host or private application network.
- Limit administrative access through a VPN, identity-aware proxy, or narrowly scoped source addresses when possible.
Account and scanner security
- Change the initial administrator password immediately and store it in a password manager.
- Use separate, narrowly scoped tokens for CI scanners instead of sharing an administrator token.
- Prefer short-lived tokens or a documented rotation schedule.
- Remove unused users, tokens, and integrations after a migration or proof of concept.
Connect scanners from CI
Install the scanner appropriate to each build system and point it at the HTTPS URL of your VPS. Store the scanner token as a protected CI secret, inject it only into the analysis job, and prevent it from appearing in command output.
- Create a project in the server and generate a token with the minimum scope required for analysis.
- Add the server URL and token to the CI platform’s secret store.
- Run the scanner after compilation or test steps when the analyzer needs compiled output.
- Set a quality gate or equivalent pipeline check so failed analysis blocks merges according to your team’s policy.
- Start with one repository, verify report upload and background processing, then increase concurrency gradually while watching queue time and memory.
Scanner compatibility follows the server and analyzer release you selected. Read the release notes when upgrading either side, especially if a language analyzer or build integration changes.
Backups, monitoring, and routine operations
Back up two different recovery sets
Back up the external database and the server volumes separately. The database contains the authoritative application records; the data, logs, and extensions volumes contain indexes, uploaded content, diagnostics, and installed extensions. Define retention, encryption, off-host storage, and restore ownership for both sets.
Before an upgrade, take a fresh database backup and a consistent volume backup. Record the image tag, database version, proxy configuration, secret locations, and any custom plugins so a replacement VPS can be rebuilt without guesswork.
Monitor the signals that predict failure
- Free disk space and inode use on every mounted filesystem
- Heap pressure, container memory, swap activity, and out-of-memory kills
- Elasticsearch health and index failures
- Analysis queue length and time spent waiting for background processing
- Container restarts, HTTP error rates, and reverse-proxy certificate expiry
- Success and age of database and volume backups
Keep upgrades deliberate
Pin a tested image tag rather than relying on latest. Read the release and upgrade notes, confirm database and plugin compatibility, back up both recovery sets, and rehearse rollback. Use the long stop timeout shown above when analyses may still be running; the Docker guidance uses --stop-timeout 3600 so Docker does not terminate the process after its default ten-second wait.
- Announce a maintenance window and pause or drain CI analyses.
- Verify recent, restorable database and volume backups.
- Pull the new tested image tag without deleting the old image.
- Stop the container gracefully, preserving the long timeout.
- Start the new container with the same volumes and database settings.
- Review logs, database migration status, Elasticsearch health, and a representative project analysis.
- Keep the previous image and rollback instructions until the new release has passed your acceptance checks.
Common failure modes and fixes
Elasticsearch refuses to start
Check vm.max_map_count, file limits, process limits, available memory, and write permissions on the data volume. Confirm that the settings were applied to the host running Docker, not only to an unrelated shell or development machine.
The container loses data after recreation
Inspect the -v arguments and confirm that all three named volumes are still attached. Data stored only in the container layer disappears when the container is removed.
Analyses remain queued
Look for memory pressure, CPU saturation, Elasticsearch health errors, and excessive concurrent CI jobs. Reduce concurrency temporarily and increase capacity only after identifying which resource is limiting throughput.
Database connection or migration errors appear
Verify DNS, firewall rules, TLS settings, credentials, database permissions, and version compatibility. Ensure no second server instance is using the same schema.
The site is reachable on port 9000 from the internet
Remove the public firewall rule, bind the container to a private host interface where practical, and expose only the reverse proxy’s HTTPS listener. Rotate administrator and scanner credentials if the endpoint was publicly accessible.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Production-readiness checklist
- Edition and license selected for the required languages, LOC ceiling, support, and scale.
- Exact tested image tag recorded; no production dependency on
latest. - Linux kernel and file-descriptor settings applied and persisted.
- Separate persistent volumes mounted for data, logs, and extensions.
- External production database configured with encrypted transport and least-privilege credentials.
- Database schema reserved for one server instance or cluster.
- TLS reverse proxy deployed; port 9000 blocked from untrusted networks.
- Administrator authentication hardened and CI tokens scoped and rotatable.
- Database and volume backups stored separately, encrypted, and restore-tested.
- Disk, memory, Elasticsearch, queue, restart, certificate, and backup monitoring active.
- Upgrade and rollback procedure tested with a long graceful stop timeout.
Is a VPS the right deployment?
A single VPS is a good fit when one team needs a self-managed, single-node service and can perform operating-system, database, backup, and upgrade maintenance. Community Build keeps licensing simple for smaller installations. A commercial single-node edition becomes appropriate when its language, security, integration, support, or LOC capabilities are required. Data Center should be considered only when you can operate the clustered components and need resiliency beyond one server. In every case, the operational boundary is the same: the VPS owner is responsible for host security, database recovery, network exposure, capacity planning, and release management.
Frequently Asked Questions
Can the code quality server run in Docker on a VPS?
Yes. The official Docker image supports a single-VPS deployment. Prepare the Linux host for Elasticsearch, map port 9000 internally, mount separate persistent volumes, and place a TLS reverse proxy and firewall in front of the container.
Do I need PostgreSQL for the code quality server?
You need a supported external production database rather than the image’s embedded H2 database. PostgreSQL is a common choice, but verify the database engines and versions supported by the exact release you deploy.
Can two containers share one database schema?
No. Only one server or Community Build instance or cluster should connect to a database schema at a time; concurrent use can corrupt data.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What does the 3600-second Docker stop timeout do?
It gives active analyses and background processes time to shut down cleanly during maintenance. Without an extended timeout, Docker’s default ten-second wait can terminate the process abruptly.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
