The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →To self-host Bitwarden with Docker, prepare a Linux server, install Docker Engine 26 or newer, point a domain at the server, open ports 80 and 443, obtain a TLS certificate, and request a Bitwarden installation ID and key. Then choose Bitwarden Standard for a multi-container x64 deployment or Bitwarden Lite for a smaller single-container installation that also supports ARM64 hardware such as a Raspberry Pi.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The correct choice depends mainly on architecture, memory, scale and database needs. This guide explains the prerequisites, decision points, installation sequence, networking, storage, security and troubleshooting without assuming that the two deployment types have identical capabilities.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →What self-hosting Bitwarden with Docker involves
A self-hosted Bitwarden server keeps the server-side password-manager services on infrastructure you control instead of using Bitwarden’s hosted service. Docker packages those services and their dependencies so they can be started, stopped and upgraded as a deployment rather than as individually installed system packages.
There are two supported deployment paths in the current guidance summarized for this article:
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Characteristic | Standard | Lite |
|---|---|---|
| Container model | Multiple containers | Single container |
| CPU architecture | x64 only | x64 or ARM64 |
| Memory requirement | At least 2 GB RAM; 4 GB is the stated recommendation | About 200 MB minimum |
| Storage requirement | At least 12 GB; 25 GB is the stated recommendation | About 1 GB minimum |
| Database | Default MSSQL Express image, with a 10 GB maximum relational-database size; an external database is possible | Database details are not stated in the available requirements |
| Best fit | Larger installations that can provide x64 hardware and more resources | Personal or small-team deployments, including ARM64 hosts |
Both paths require Docker Engine 26 or newer. Current Docker Engine releases include Docker Compose as a plugin, so a separate legacy Compose installation should not be assumed necessary.
Bitwarden’s exact server version and hardware figures can change. Check the current requirements at Bitwarden’s help center immediately before deployment, especially if you are installing after the date of this guide.
Choose Standard or Lite before installing
Use Standard when you need the multi-container deployment
Standard is the x64-only, multi-container implementation. Its published minimum is a 1.4 GHz x64 processor, 2 GB of RAM and 12 GB of storage. The recommended target is 4 GB of RAM and 25 GB of storage. Those figures are host requirements, not a guarantee that every workload will perform identically; concurrent users, logging, backups and other services consume additional capacity.
The default Standard database is an MSSQL Express image. Its relational database has a 10 GB maximum. If your retention, attachment or organizational requirements exceed that limit, the documentation allows an external database, but the external database’s sizing, supported engine and migration procedure must be checked in the current Bitwarden instructions.
Use Lite for a small installation or ARM64 host
Lite consolidates the deployment into one container and has a much smaller stated footprint: approximately 200 MB of RAM and 1 GB of storage as minimums. It runs on both x64 and ARM64, making it the appropriate Bitwarden option for an ARM64 server or Raspberry Pi. Treat those numbers as a floor: the operating system, Docker, backups, logs and actual vault activity still need headroom.
Architecture is the first filter
Confirm the host architecture before downloading anything. Standard’s official implementation does not support ARM. If the machine reports ARM64, choose Lite rather than trying to force Standard through emulation. Emulation can add complexity and does not change the support boundary.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteRank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Prerequisites checklist
Complete these items before running a Bitwarden installer:
- Linux host: use a supported Linux server with a non-root administrative account.
- Docker: install Docker Engine 26 or newer and verify that the Docker Compose plugin is available with that installation.
- Installation credentials: request an installation ID and installation key from Bitwarden’s self-host portal using an email address. Keep both values private.
- DNS: create a DNS record for the hostname you will use and point it to the server’s public IP address before installation.
- Network access: allow inbound TCP port 80 for HTTP and certificate validation, and TCP port 443 for HTTPS. If the server is behind a router, forward those ports to it.
- TLS: plan a signed certificate for the hostname. Let’s Encrypt is the usual route and requires a domain that resolves to the host.
- Capacity: reserve the memory and storage shown in the deployment table, plus working space for the operating system, Docker images, updates and backups.
Prepare Docker and the host
Use a non-root account
Do not run the Bitwarden installer as root. Sign in with a dedicated administrative user and grant only the Docker permissions that your operating-system setup requires. If you use sudo for Docker administration, keep that elevation explicit rather than turning an interactive root shell into the normal installation environment.
Verify the Docker release
Check the installed engine and Compose plugin before downloading Bitwarden:
docker --version
docker compose versionThe engine must be version 26 or newer for either deployment. If the first command reports an older release, upgrade Docker before proceeding; guides that mention 20.10.x or 24.x do not meet the current requirement summarized here.
Check architecture, memory and storage
On Linux, commands such as uname -m, free -h and df -h let you compare the host with the selected deployment’s requirements. An x86-64 result is compatible with Standard; an ARM64 result limits you to Lite. Leave free disk space beyond the published minimum so an update or backup cannot fill the filesystem.
Confirm Docker can start containers
Before introducing Bitwarden, run a harmless Docker test image and remove it afterward. The test proves that the daemon, image retrieval and container networking work independently of Bitwarden. If it fails, fix Docker permissions, daemon status or outbound connectivity first; troubleshooting Bitwarden on a broken Docker installation obscures the real cause.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Set DNS, ports and HTTPS in the right order
Point the hostname at the server
- Choose the fully qualified hostname users will enter for Bitwarden.
- Create an A record for an IPv4 address, or the appropriate IPv6 record if your deployment is designed for IPv6.
- Wait for the record to resolve publicly to the server before certificate issuance.
- Check resolution from a network outside your home or office, because an internal-only DNS answer will not satisfy a public certificate authority.
The hostname must resolve before installation because certificate validation depends on reaching the correct host.
Open only the required web ports
Allow TCP 80 and TCP 443 through the host firewall, cloud security group and any upstream router. Port 80 is used for HTTP access and certificate validation; port 443 carries the encrypted web service. Do not assume that opening a port in only one firewall layer is sufficient.
Recommended Free Tools
Plan the certificate
Use a certificate whose name matches the hostname. Let’s Encrypt is a common choice when the domain resolves publicly and port 80 can be reached for validation. A certificate that is self-signed, issued for a different name or allowed to expire will produce browser warnings or prevent clients from connecting securely.
Request and protect the installation ID and key
Bitwarden requires an installation ID and installation key for self-hosting. Request them from the self-host portal with an email address before you start the installer. Store the values in a password manager or another protected secrets store, and do not place them in a public repository, forum post or shell transcript.
These credentials identify the installation; they are not a substitute for your user account’s master password. Keep a secure recovery copy so a rebuild does not depend on an inaccessible mailbox or an old terminal session.
Install the selected deployment
The exact installer prompts and server version can change, so use the current Bitwarden installation procedure for the Standard or Lite path you selected. The sequence below shows what the installer must accomplish and the decisions you should make when it asks for them.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Download the current installer: obtain it from Bitwarden’s official self-host documentation and place it in a dedicated directory owned by your non-root administrative user.
- Enter the hostname: provide the DNS name that already resolves to this server. Do not substitute an unqualified machine name if users will connect through a public domain.
- Supply the installation ID and key: paste the values issued by the self-host portal exactly, without surrounding spaces.
- Select the deployment: choose Standard on a supported x64 host when you need the multi-container architecture; choose Lite for a smaller deployment or any ARM64 host.
- Configure HTTPS: enable the certificate workflow offered by the current installer, or provide the certificate and key according to the documented reverse-proxy method. Keep private-key permissions restrictive.
- Start the services: let the installer create the required Docker resources, then wait for every container in the chosen deployment to report a running or healthy state.
- Test the URL: open the HTTPS hostname in a browser and verify that the certificate name, login page and secure connection are correct before inviting other users.
Do not mix files from Standard and Lite. Their container layouts differ, and copying a compose file or environment file from one deployment into the other can produce missing services or invalid settings.
Understand Standard’s database boundary
Standard’s default MSSQL Express image is capped at 10 GB for the relational database. That limit is distinct from the host’s total disk capacity: a server may have free disk space while the database itself has reached its supported maximum. Monitor database growth and plan retention and backups accordingly.
An external database is possible with Standard. Before choosing it, verify the current Bitwarden documentation for supported database engines, network security, credentials, backup consistency and migration steps. Do not expose a database directly to the public internet merely to make the container reachable; place it on a private network and restrict access to the Bitwarden services.
Storage, backups and recovery
Persist the data directories
Containers are replaceable; vault data, configuration, certificates and database files must live in persistent Docker volumes or host-mounted directories. Identify those paths from the installer output and include them in your backup plan. Deleting a container must not delete the persistent data needed to restore the service.
Back up more than the database
A usable recovery set normally includes the Bitwarden data volume, database contents, configuration and TLS material, plus the installation credentials stored separately. Encrypt backups, restrict access and keep at least one copy away from the Docker host. Test a restoration on an isolated machine rather than assuming that a successful file copy proves recoverability.
Watch capacity
Monitor filesystem usage, Docker image layers, logs and the Standard database limit. On a small Lite host, the approximately 1 GB minimum leaves little room for growth; schedule cleanup and backups before the filesystem approaches 100 percent.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Secure the exposed service
- Use HTTPS on the real hostname and redirect or otherwise prevent unintended plaintext use after certificate validation.
- Keep Docker Engine, the Bitwarden deployment and the host operating system updated according to their release guidance.
- Restrict SSH and administrative interfaces separately from ports 80 and 443.
- Protect installation credentials, database passwords, certificate private keys and backup archives as secrets.
- Use strong, unique master passwords and enable the account protections available in your Bitwarden client.
- Review container logs and host authentication logs for repeated failures or unexpected access.
Common failure modes and fixes
The installer reports an unsupported Docker version
Confirm both commands shown earlier. Upgrade Docker Engine to 26 or newer, then rerun the installation using the current documentation. Older third-party tutorials are not a reason to retain an unsupported engine.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The certificate request cannot validate
Check that public DNS returns the server’s current IP, that port 80 reaches the host, and that no other web server is answering for the hostname. Correct DNS or firewall routing before requesting another certificate.
The browser shows a certificate warning
Inspect the certificate’s subject and expiration date. A name mismatch means the hostname configured in Bitwarden and the name on the certificate differ; an expired certificate requires renewal and a service reload.
Users cannot connect from outside the LAN
Test the public DNS answer and both port-forwarding and cloud-firewall rules. Internal split-horizon DNS can make the service appear healthy on the LAN while external clients receive a private or stale address.
Standard will not start on a Raspberry Pi
This is an architecture mismatch. Standard is x64-only. Rebuild the host with an x64 machine or deploy Lite, which supports ARM64.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesContainers repeatedly restart
Inspect logs for the specific failing container, then check available memory, persistent-volume permissions, certificate paths and installation credentials. On a host near the published memory floor, stop unrelated workloads before concluding that the Bitwarden configuration is defective.
The database is approaching its limit
For Standard’s default MSSQL Express database, treat 10 GB as a hard product boundary rather than a warning threshold. Review retention and growth, then evaluate the documented external-database option before the limit is reached.
Operational checklist after first login
- Confirm the browser shows the expected hostname and a valid HTTPS certificate.
- Create a test account or organization only after the administrator login works.
- Log out and back in from a second client or network to verify external reachability.
- Take an encrypted backup and document where the persistent data and certificate files reside.
- Record the Docker, deployment and host versions so an upgrade can be reproduced.
- Schedule checks for certificate expiry, disk usage, database growth and failed container health.
- Document the restore procedure and test it before the server becomes your only copy of the vault.
Which deployment should you choose?
Choose Lite when the priority is a compact personal or small-team server, especially on ARM64 hardware. Choose Standard when you have supported x64 hardware, need its multi-container layout, expect a larger installation, or need the documented external-database path. In either case, size the host above the minimum when it will also run backups, monitoring, reverse proxies or other applications.
The safest installation is the one whose architecture, memory, storage, DNS and certificate plan are correct before the first container starts. Once those foundations are in place, Docker makes the Bitwarden services reproducible; it does not remove the need to maintain the host, protect secrets and test recovery.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
