To self-host Concourse CI on a Linux VPS, run its web node and worker against PostgreSQL, expose the web interface over HTTPS on port 443, and allow workers to reach the web node’s TSA endpoint on port 2222. The official deployment order is PostgreSQL, secrets and keys, web node, then worker. A single VPS can combine roles for a small, lightly loaded team, but separate hosts provide better isolation, storage durability, and scaling.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What a Concourse installation contains
Concourse is not a single stateless web container. The documented installation is composed of three cooperating parts:
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Component | Responsibility | Typical placement |
|---|---|---|
| Web node | Serves the UI and API, schedules work, runs the TSA endpoint, and coordinates workers. | Publicly reachable VPS or private VM behind a TLS-capable firewall. |
| Worker node | Runs task and resource containers, fetches inputs, and performs build work. | One or more dedicated Linux VMs; workers should be treated as disposable. |
| PostgreSQL node | Stores pipeline configuration, state, build metadata, logs, and TLS material used by the built-in certificate integration. | A managed or separately backed-up PostgreSQL service, or a database on the VPS for a small installation. |
The official high-level sequence is deliberate: prepare PostgreSQL, generate and protect keys, start the web node, and only then start workers. PostgreSQL may be local or remote, but the web node must be able to connect to it. The Docker Compose documentation assumes web and worker services on separate servers. Putting both on one VPS is a practical simplification of that topology, not a different Concourse architecture.
Choose a VPS layout before installing
Single-VPS layout
One Linux VPS can host Docker, the web container, the worker container, and PostgreSQL. This is inexpensive and easy to operate for a small team with light pipelines. It also puts the privileged worker, public web service, database, and all build I/O in one failure and security domain. A full disk, runaway build, kernel problem, or compromised workload can affect every role.
#1 Best Overall
- WHY CHOOSE G3 ULTRA MINI PC PENTIUM GOLD 7505 - Choose the Intel Pentium Gold 7505 for snappier everyday responsiveness: It delivers up to 30% faster single-core performance than the Ryzen 5 3500U, making office apps and web browsing feel noticeably quicker, while its Intel UHD Graphics (48 EUs) provides 2.4x the GPU performance of the N100 & N150's 24-EU graphics, ensuring smoother 4K streaming and light photo editing.
- 16GB RAM MEMORY & 512GB STORAGE - GMKtec Nucbox G3 Ultra mini computer is prebuilt with 16GB LPDDR4 RAM at 3200 MT/s, you will enjoy a speedier experience with Built-in 512GB M.2 SATA Hard Drive. Our mini desktop pc boots up in seconds, work on multiple browser tabs, software applications and quickly transfers files. There is a primary slot and secondary expansion storage. Primary slot is M.2 2280 PCIE and secondary slot is M.2 2280 SATA.
- RICH INTERFACE - Nucbox pentium mini computer is equipped with 3* USB 3.2 Gen2 ports, up to 10Gbps/S, 1*USB 2.0, HDMI(4K@60Hz)*2, 3.5mm Audio Jack. Supports WiFi 6, and Gigabit Ethernet RJ45 2.5GbE network connectivity, Bluetooth 5.2. This Mini PC supports multiple device connection and can be used with servers, monitoring equipment, office equipment, displays, projectors, televisions, etc.
- 4K DUAL SCREEN DISPLAY - Mini desktop computer is equipped with upgraded Intel Graphics(max 1000MHz), supports 4K video playback and AV1 decoding, connect the pc with a projector as a home theatre, enjoy a variety of entertainments. Two HDMI 2.0 ports allows you to multi-task efficiently on two 4K@60Hz displays.
- UPGRADED COOLING FAN - The G3 Ultra has upgraded the cooling fan to reduce fan noise and thermals. We are using an upgraded thermal paste as well to help reduce heat on the CPU.
Separated layout
A cleaner production arrangement uses one web host, one or more worker hosts, and a durable PostgreSQL service or database VM. Workers can be added without moving the web service. PostgreSQL can have independent backups and storage. The trade-offs are additional hosts, network configuration, and latency between components.
| Decision axis | Single VPS | Separated hosts |
|---|---|---|
| Isolation | Web, database, and a privileged worker share a kernel and storage. | Worker, web, and database trust boundaries can be separated. |
| Scaling | Vertical resizing is the main option. | Add workers horizontally and resize database or web nodes independently. |
| Database durability | Depends on the VPS disk and your backup process. | Can use dedicated storage, replicas, or a managed database. |
| Network design | Mostly local traffic, but one host is a larger blast radius. | Requires private routing and firewall rules between hosts. |
| Operations | Fastest first deployment and fewest moving parts. | More setup, but easier maintenance and fault isolation later. |
VPS prerequisites and realistic sizing
There is no universal official CPU, RAM, disk, bandwidth, or price minimum for a Concourse VPS. Resource use is determined by the number and type of concurrently running containers, checkout sizes, image layers, artifact retention, build logs, and database connections. Treat any initial size as a planning choice, not a tested minimum.
- Use a Linux VPS with Docker Engine and Docker Compose available.
- For Linux workers, the documented tested distributions are Ubuntu 22.04 and Ubuntu 24.04 with kernel 5.15 or newer.
- Enable user namespaces plus memory and swap accounting on worker hosts.
- Keep enough disk for the worker work directory, container layers, caches, and temporary artifacts. Worker state is ephemeral, so use disposable storage rather than treating it as the source of truth.
- Provide outbound connectivity from workers to source repositories, container registries, package mirrors, and every external service referenced by pipelines.
- Use a DNS name such as
ci.example.compointed at the web host. SetCONCOURSE_EXTERNAL_URL=https://ci.example.com.
Size each role for its actual job. The web node handles scheduling and API traffic. PostgreSQL needs connection capacity, fast durable storage, and room for build-log retention. Workers need CPU, RAM, disk I/O, and network bandwidth for concurrent containers. The web node’s documented default API connection pool is 10 and its backend pool default is 50; high-concurrency installations should review database limits instead of assuming a small default is sufficient.
Plan DNS, TLS, and firewall rules
For a public installation, use HTTPS rather than exposing the web interface over plain HTTP. Concourse can request a Let’s Encrypt certificate when the hostname is reachable from the internet and CONCOURSE_ENABLE_LETS_ENCRYPT=true is set. The certificate and private key are stored in PostgreSQL, so database encryption and encrypted backups are mandatory when using this integration.
| Traffic | Port | Firewall guidance |
|---|---|---|
| Users and ACME validation to the web node | TCP 443 | Allow from the internet if the UI and certificate validation must be public. |
| Worker TSA connection to the web node | TCP 2222 by default | Allow only from worker addresses or a private network. |
| Web node to PostgreSQL | Normally TCP 5432 | Allow only between the web host and database host; use encrypted PostgreSQL connections. |
| Garden traffic | TCP 7777 | Keep private. Worker traffic is forwarded through the SSH/TSA connection. |
| BaggageClaim traffic | TCP 7788 | Keep private. It is also forwarded through TSA in the normal worker setup. |
| Worker egress | Destination-dependent | Permit access to repositories, registries, APIs, and other pipeline inputs. |
Do not publish ports 7777 or 7788 merely because they appear in worker documentation. The web node reaches them through the TSA SSH connection. If a worker cannot resolve names inside build containers, configure containerd DNS and test from an intercepted build container. Enabling host access can solve some DNS designs but expands the security exposure because containers may then reach processes on the worker host.
Prepare PostgreSQL and protect secrets
Create a PostgreSQL database named atc and a dedicated database user, or use equivalent names in your configuration. The web node must be able to reach the database host and port. Use encrypted client connections and encrypt backups, including the database contents that hold build logs and TLS material.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Rank #2
- 12th Intel Alder Lake N95 Processor – The GMKtec G3 S Mini PC is powered by the 12th Gen Intel N95 processor with 4 cores, 4 threads, 6MB cache and a burst frequency up to 3.4GHz. Compared with N100/N5105/N5100/N5095, the N95 delivers up to 36% overall performance improvement. Perfect for routine tasks, office work, and home entertainment, this compact mini desktop is more convenient than traditional bulky PCs.
- 8GB RAM & 256GB SSD Storage – Pre-installed with 8GB DDR4 memory and a fast 256GB M.2 2242 SSD, the G3 S mini desktop offers quicker startup, smoother multitasking, and faster file transfers. Enjoy seamless performance whether you’re working on multiple applications, browsing, or streaming content.
- Rich Interfaces & Connectivity – The G3 S mini computer comes equipped with USB 3.2 (up to 10Gbps), dual HDMI 2.0 (4K@60Hz), and a 3.5mm audio jack. With support for WiFi 5, Bluetooth 5.0, and Gigabit Ethernet (RJ45 1000MbE), it connects easily with monitors, projectors, printers, office equipment, and other peripherals, making it versatile for both home and business use.
- Dual 4K Display Support – Featuring upgraded Intel UHD Graphics (up to 1000MHz), the G3 S supports 4K video playback and AV1 decoding for a smooth viewing experience. With dual HDMI outputs, you can connect two 4K@60Hz displays simultaneously, enabling efficient multitasking for work and entertainment.
- GMKTEC WARRANTY - GMKtec offers a 3-year limited warranty (1 year replacement + 2 years parts replacement) for each mini PC, starting from the date of the purchase effective on all sales starting Oct. 2026. All defects due to design and workmanship are covered. With a professional after sales team always ready to attend to your needs, you can simply relax and enjoy your mini PC
Generate the keys before starting either service and mount them read-only inside containers. The web node requires:
session_signing_keytsa_host_keyworker_key.pub, the authorized public key for workers
The worker requires the matching private and public material:
tsa_host_key.pubworker_key
Use the key-generation command supplied with the same Concourse release you plan to run, and verify ownership and permissions before launching containers. Keep the private files out of Git repositories, pipeline definitions, shell history, and world-readable directories. Rotate database credentials and key files through the VPS’s secret-management procedure.
Deploy the web node with Docker Compose
The following sequence is an implementation outline. Adjust image tags, database variables, and file paths to the Concourse release you have selected. The Compose guide uses the official concourse/concourse image and a web command.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →- Create a deployment directory and a key directory on the web host.
- Copy the web key files into that directory and make the key volume read-only.
- Point DNS at the host and confirm that TCP 443 can reach it before enabling automatic certificate issuance.
- Set the PostgreSQL connection variables and the external HTTPS URL.
- Publish host port 443 to the web container’s port 8080 and host port 2222 to the container’s TSA port.
- Start the service with
docker compose up -dand inspect startup logs.
services:
concourse-web:
image: concourse/concourse
command: web
restart: unless-stopped
ports:
- "443:8080"
- "2222:2222"
volumes:
- ./keys:/concourse-keys:ro
environment:
CONCOURSE_EXTERNAL_URL: https://ci.example.com
CONCOURSE_POSTGRES_HOST: ${POSTGRES_HOST}
CONCOURSE_POSTGRES_PORT: "5432"
CONCOURSE_POSTGRES_USER: ${POSTGRES_USER}
CONCOURSE_POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
CONCOURSE_POSTGRES_DATABASE: atc
CONCOURSE_SESSION_SIGNING_KEY: /concourse-keys/session_signing_key
CONCOURSE_TSA_HOST_KEY: /concourse-keys/tsa_host_key
CONCOURSE_TSA_AUTHORIZED_KEYS: /concourse-keys/worker_key.pub
CONCOURSE_ENABLE_LETS_ENCRYPT: "true"
Use an external authentication provider for a shared team. The sample Compose configuration demonstrates local authentication with a value such as CONCOURSE_ADD_LOCAL_USER=test:test and assigns that account to the main team, but that is an example only. Replace it with sensible credentials or a documented external provider, and remove sample local-user variables from a real deployment.
If the web container exits, inspect the database hostname, credentials, certificate reachability, mounted key paths, and file permissions first. A valid HTTPS URL that does not resolve to the VPS, or a firewall that blocks ACME validation, will prevent automatic certificate issuance.
Rank #3
- ➊ [ Trusted Quality for Everyday Agentic AI ] GEEKOM equips its SSDs with reliable original-grade flash and conducts rigorous stability testing to support dependable everyday operation. This commitment to quality is backed by a 3-year warranty. Simply connect the Air12 to cloud AI services for research, writing, study support and daily productivity—no NPU or complex local setup required. Designed for students, home users, light office work and first-time buyers, the Air12 is a high-value Cloud Agentic PC for everyday tasks
- ➋ [ Intel 7505 processor ] Powered by the Intel 7505 processor (2 cores, 4 threads, up to 3.5GHz), the GEEKOM Mini PC Air12 delivers smooth performance for everyday computing, office tasks, and home entertainment. With enhanced single-core processing, it handles daily workloads efficiently and responsively. Compact, quiet, and energy-efficient — a solid alternative to bulky desktops.
- ➌ [440lbs(200kg) Pressure Rated Metal Frame for Demanding Environments] Unlike the Plastic Shells You’ll Find on Most Mini PCs, geekom Mini Air12 features a triple-reinforced ABS+PC shell, precision-crafted metal frame and baseplate—engineered to withstand up to 440 lbs of pressure for the perfect balance of strength and thermal efficiency. Tool-free upgrades, shock-absorbing feet, and a 3D antenna deliver true durability
- ➍ [Dual-Channel RAM & NVMe SSD Expandability] Ships with 8GB DDR4 RAM and a 256GB NVMe SSD for smooth everyday performance. Dual memory slots and dual storage slots give you the flexibility to upgrade to 64GB RAM and 2TB SSD, so your system can adapt as your workload grows. Enjoy faster load times, smoother multitasking, and long-term reliability.
- ➎ [Triple 4K Displays for Maximum Productivity] Connect up to three 4K monitors via HDMI 2.0, Mini DisplayPort 1.4, and USB-C — ideal for stock trading dashboards, multi-tab research, office document editing, and light spreadsheet work. WiFi 6 and Bluetooth with high-gain antenna ensure stable wireless connections throughout your workspace. 5x USB ports and a full-size SD card reader provide quick access to peripherals and camera files — no adapters required.
Deploy and register a Linux worker
Workers orchestrate containers and therefore run as root. In Compose, the worker service is privileged and uses the containerd runtime with the overlay BaggageClaim driver. This is a major trust boundary: run only trusted pipeline workloads and isolate the worker network and host from unrelated services.
- Prepare a tested Ubuntu 22.04 or 24.04 worker host with kernel 5.15 or newer.
- Enable user namespaces, memory accounting, and swap accounting according to your distribution’s kernel and boot configuration.
- Install Docker Engine and Compose, create a worker directory, and place the worker private key plus the TSA public key in a read-only key directory.
- Allow the worker host to reach the web host on TCP 2222. Do not open 7777 or 7788 to the public internet.
- Set the worker’s TSA host to the web hostname and port, then start it with
docker compose up -d. - Install or download
flyfrom the Concourse web UI, authenticate to the external URL, and runfly workers.
services:
concourse-worker:
image: concourse/concourse
command: worker
restart: unless-stopped
privileged: true
volumes:
- ./keys:/concourse-keys:ro
- ./worker-work:/concourse-work
environment:
CONCOURSE_RUNTIME: containerd
CONCOURSE_BAGGAGECLAIM_DRIVER: overlay
CONCOURSE_TSA_HOST: ci.example.com:2222
CONCOURSE_TSA_PUBLIC_KEY: /concourse-keys/tsa_host_key.pub
CONCOURSE_TSA_WORKER_PRIVATE_KEY: /concourse-keys/worker_key
CONCOURSE_WORK_DIR: /concourse-work
The exact worker key filenames and environment-variable paths must match the files you generated and mounted. A successful container start is not proof of registration; fly workers should show the worker as registered and healthy.
Recommended Free Tools
Understand worker runtime, networking, and security
Why the worker is privileged
Concourse workers create and manage the containers that execute tasks, so the worker process must run as root. Privileged mode gives the worker broad control over the host kernel and container runtime. Keep workers on dedicated VMs when possible, patch the host, restrict administrative access, and avoid placing unrelated applications on the same machine.
Why workers need broad outbound access
Resource checks and builds commonly fetch code, images, packages, and APIs from arbitrary external locations. Egress filtering must therefore be designed around your pipelines rather than a short fixed allowlist. Workers do not need publicly reachable Garden or BaggageClaim ports in the standard TSA arrangement.
How to scale workers
Workers are stateless and interchangeable. Add another worker VM when concurrency rises instead of starting multiple worker processes on one machine; processes on one host still compete for the same CPU, memory, disk, and kernel resources. The worker documentation suggests considering an additional worker when the average container count approaches about 200 per worker. That is a planning signal, not a universal capacity limit.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Verify the installation and diagnose common failures
Check service logs
docker compose logs -fRun the command in the web or worker Compose directory. Look for database authentication errors, missing key files, TLS issuance failures, and TSA connection failures.
Rank #4
- 【AMD Ryzen 4300U True 4-Core CPU: Outperforms N95 & i3-10110U】KAMRUI P2 Mini PC is equipped with true 4-core AMD Ryzen 4300U processor built on advanced 7nm Zen2 architecture，This means you get consistent, unthrottled performance for hours on end, whether you’re running multiple browser tabs, streaming 4K content, or managing virtual machines. Compare that to Intel N95 (4 efficiency cores that throttle under load) or Intel i3-10110U (only 2 cores total), and the difference is night and day: The KAMRUI P2 AMD Ryzen 4300U (28W) is 40% faster than the Intel i3-10110U and 25% faster than the Intel N95 in multi-core tasks, ensuring smooth, lag-free performance even during heavy workloads.
- 【Integrated AMD Radeon Graphics: 2.5X Stronger for Tri 4K】The KAMRUI P2 AMD 4300U Mini PC have unlocked the full potential of the built-in AMD Radeon Vega 5 graphics with 28W power delivery, making it 2.5 times stronger than the Intel UHD graphics found in the N95 and i3-10110U. This means you can enjoy Tri 4K@60Hz displays without a single stutter, perfect for productivity setups, home theaters, or even light photo/video editing and casual gaming. While the Intel N95/i3-10110U struggle to run a single 4K display without lag, The KAMRUI AMD 4300U Mini PC handles Tri 4K effortlessly, turning your workspace into a high-efficiency hub or your living room into a premium entertainment center.
- 【Large Storage Capacity, Easy Expansion】KAMRUI Pinova P2 mini computers is equipped with 16GB LPDDR4 for faster multitasking and smooth application switching. 512GB M.2 SSD ensures fast startup, fast file transfers and plenty of storage space,eliminating slow loading times and ensuring fast responsiveness. the two storage slots (1x M.2 2280 SATA/NVMe PCIe3.0 slot, 1x M.2 2280 SATA slot) can be combined to provide up to 4TB of total storage(Not included). This gives you enough space for all your projects, media and data.
- 【4K Triple Display】KAMRUI Pinova P2 4300U mini desktop computers is equipped with HDMI2.0 ×1 +DP1.4 ×1+USB3.2 Gen2 Type-C ×1 interfaces for faster transmission, Triple 4K@60Hz Display, KAMRUI P2 mini computer is ideal for visual home entertainment, home office, conference rooms, etc. USB3.2 Gen2 Type-A port ×2 with a transfer speed of up to 10 Gbps (21 times faster than USB 2.0) for efficient data transfer. Ideal for seamless multitasking between spreadsheets, browsers and presentations, or for an immersive entertainment experience.
- 【USB3.2 Gen2 Type-C 10Gbps, Versatile connectivity】KAMRUI P2 mini desktop pc fast and versatile connectivity! The USB3.2 Gen2 Type-C port offers a data transfer rate of 10Gbps and simultaneously supports DisplayPort 1.4 video output. The P2 AMD Ryzen 4300U Mini PC is complemented by Gigabit LAN, WiFi and Bluetooth, so nothing stands in the way of a productive working environment.
Confirm worker registration
fly -t main login -c https://ci.example.com
fly -t main workersThe worker should appear with a healthy state. If it does not, check that TCP 2222 is allowed from the worker, that the worker’s TSA public key matches the web node’s authorized public key, and that the external hostname resolves from the worker.
Recover a stalled worker
When a worker is unresponsive, stop scheduling work to it where possible and investigate host CPU, RAM, disk, and container-runtime errors. Use fly prune-worker to remove a worker record that is permanently gone. Before a planned shutdown, land the worker so new work is not assigned to it.
Debug container DNS
If a host can resolve a name but a build container cannot, inspect containerd DNS configuration and test resolution from an intercepted build container. Do not enable host networking reflexively: host access may restore name resolution while allowing containers to reach local host services.
Authentication, TLS, and database protection checklist
- Use
CONCOURSE_EXTERNAL_URLwith an HTTPS URL that resolves to the web node. - Enable Let’s Encrypt only when the hostname is publicly reachable and port 443 is open for validation.
- Encrypt PostgreSQL connections and database backups because PostgreSQL stores Concourse state, build logs, and the Let’s Encrypt certificate and key.
- Replace sample local credentials with an external authentication provider for shared installations.
- Keep all private Concourse and database credentials outside source control.
- Restrict TSA port 2222 to worker hosts or a private network.
- Leave worker ports 7777 and 7788 private.
- Back up PostgreSQL before upgrades and verify that backups can be restored.
Plan upgrades and routine operations
Concourse runs database migrations automatically when a web node starts. Web nodes can be restarted without draining, but do not leave nodes on mixed versions: a migration performed by a newer node can confuse older nodes. Upgrade all web and worker nodes to the same release promptly.
- Read the release notes and confirm that your PostgreSQL backup includes build logs and stored TLS material.
- Back up PostgreSQL and record the current Concourse and worker versions.
- Upgrade the web node and watch
docker compose logs -fwhile migrations run. - Upgrade workers to the same version, one at a time when capacity allows.
- Run
fly workers, start a representative pipeline, and verify resource checks, container creation, artifact handling, and log retrieval.
For a host-managed alternative, Concourse is also distributed as a binary. The Linux archive can be extracted under /usr/local/concourse; the binary discovers sibling assets such as resource types automatically. Configuration flags and CONCOURSE_* environment variables are equivalent, so systemd services are a reasonable choice when you want host-managed processes instead of Compose. Docker Compose remains the clearest first deployment path on a VPS.
When to move beyond one VPS
Separate the database when build-log retention, connection count, or disk durability matters more than installation simplicity. Add workers when queues grow or average container usage approaches the documented 200-container planning signal. Move the web node to its own host when privileged build workloads should not share a kernel with the public API. Revisit the network when bandwidth or latency between web, workers, and PostgreSQL becomes a scheduling or artifact bottleneck.
A small installation can begin with one modest VPS, provided workloads are light, backups are tested, and the operator accepts the single-host failure domain. There is no evidence-based universal VPS specification to copy; measure pipeline concurrency and storage growth, then resize or separate roles as those measurements demand.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
