To self-host Drone CI on an Ubuntu VPS, run a persistent Drone server container and at least one separate runner container. The server authenticates users, receives webhooks, queues pipelines and serves the interface; runners poll the server, claim queued work and execute it. A reliable deployment therefore needs Docker, durable server storage, an exact public hostname, SCM OAuth credentials, HTTPS configuration and the same RPC secret on both containers.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The Docker runner is the practical baseline for stateless, containerized builds. It launches each pipeline step in an ephemeral container, so workloads that must retain files on the host, require unusual operating systems or need specialized isolation may be better matched to an SSH or VM runner.
As an Amazon Associate I earn from qualifying purchases.
How Drone CI is arranged
Drone is not a single process that builds everything itself. Its control plane and execution plane are separate:
- Server: stores configuration and pipeline state under
/data, handles SCM OAuth login, receives repository events, queues work and exposes the web UI and RPC endpoint. - Runner: a standalone daemon that polls the server for pending pipelines, asks for work and reports results. The Docker runner starts short-lived containers for pipeline steps.
This split lets you add runners without moving the server. It also means a runner can appear healthy only when its RPC protocol, hostname, secret and network path all agree with the server.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Prerequisites and decisions
Ubuntu VPS and Docker
Provision an Ubuntu VPS that can run Docker and has a stable public IP or a DNS record that follows it. Install Docker Engine from the current Ubuntu-supported package source, enable the Docker service at boot, and verify that the deployment user can run docker ps. The official Drone examples use Docker images for both components.
Choose the public name before creating OAuth credentials
Pick the final hostname, such as ci.example.com, and create its DNS record before registering the SCM application. Drone uses the externally visible hostname in redirects and in runner RPC settings. Changing it later requires updating the OAuth application, server environment and runner environment together.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Register an SCM OAuth application
Drone supports providers including GitHub, GitLab and Gitea. In the provider’s developer settings, create an OAuth application and copy its client ID and secret. Set the authorization callback to the exact HTTPS scheme, host and provider-required path. For example, if the provider specifies Drone’s login callback, the value would be https://ci.example.com/login; do not substitute an HTTP URL, an internal IP address, a trailing path variant or a different hostname.
Provider environment variable names differ. GitHub uses variables such as DRONE_GITHUB_CLIENT_ID and DRONE_GITHUB_CLIENT_SECRET; other providers have their own DRONE_… names. Use the pair documented for the provider you selected.
Generate and protect the RPC secret
Create a long, random value and store it in a password manager or secret store. The server and every runner must receive the identical DRONE_RPC_SECRET. Treat it like a credential: do not commit it to a repository, paste it into a public issue or expose it in shell history where other users can read it.
Decide where TLS terminates
You can terminate TLS directly at Drone or at a reverse proxy or load balancer in front of Drone. In either case, DRONE_SERVER_HOST must be the external hostname and DRONE_SERVER_PROTO should be https when users reach the service over HTTPS. A proxy must forward requests to the server, preserve the original host, communicate the HTTPS scheme and support upgraded connections used by interactive web features.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchChoose a runner for your workloads
| Runner | Isolation and execution | Best fit | Persistence and caveats | Maturity in the documented options |
|---|---|---|---|---|
| Docker | Each pipeline step runs in an ephemeral Docker container. | Stateless, containerized Linux builds on amd64, arm or arm64 hosts. | Host files are not retained between executions; poorly suited to stateful pipelines that need persistent folders. | Default baseline for a Dockerized Ubuntu deployment. |
| SSH | Runs work on an existing host reached over SSH. | Builds that need a preconfigured machine or host-level tools. | Persistence and isolation depend on how that host is administered; you must manage its operating system and access controls. | Supported alternative when Docker semantics are not appropriate. |
| VM | Can provision pools of cloud virtual machines for jobs. | Workloads needing stronger machine isolation or disposable VM environments. | Requires cloud-pool configuration and has more moving parts than a single Docker runner. | Release-candidate software in the documented comparison, not the conservative starting point. |
Deploy the Drone server
1. Create persistent storage
On the VPS, create the host directory that will survive container replacement:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
sudo mkdir -p /var/lib/drone
sudo chown root:root /var/lib/drone
The bind mount /var/lib/drone:/data is the important part. Without it, deleting or recreating the server container can remove its local state.
2. Start a direct HTTPS-capable server
The following baseline publishes the web ports used in Drone’s official GitHub example. Replace the provider variables and values with your own credentials, hostname and generated secret:
Free tools Windows power users keep installed
One-click scans. No signup required.
docker run -d --name drone --restart=always -p 80:80 -p 443:443 -v /var/lib/drone:/data -e DRONE_SERVER_HOST=ci.example.com -e DRONE_SERVER_PROTO=https -e DRONE_RPC_SECRET=replace-with-random-secret -e DRONE_GITHUB_CLIENT_ID=replace-with-client-id -e DRONE_GITHUB_CLIENT_SECRET=replace-with-client-secret drone/drone:2
drone/drone:2 is the server image line. Keep the data mount and restart policy even when you later move TLS or change the published ports. Open only the ports you actually use in the VPS firewall; if a separate proxy owns ports 80 and 443, bind Drone to an internal address and port instead.
3. Use a reverse proxy when it terminates TLS
With a proxy, the flow is client HTTPS to the proxy, then proxy HTTP (or an internal HTTPS hop) to Drone. Set DRONE_SERVER_PROTO=https because that variable describes the public scheme, not the protocol on the private hop. Set DRONE_SERVER_HOST to the public DNS name, not the container name or private address.
A typical arrangement publishes only an internal listener from the container, for example:
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesRank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
docker run -d --name drone --restart=always -p 127.0.0.1:8080:80 -v /var/lib/drone:/data -e DRONE_SERVER_HOST=ci.example.com -e DRONE_SERVER_PROTO=https -e DRONE_RPC_SECRET=replace-with-random-secret -e DRONE_GITHUB_CLIENT_ID=replace-with-client-id -e DRONE_GITHUB_CLIENT_SECRET=replace-with-client-secret drone/drone:2
Configure the proxy to forward the exact hostname, the original HTTPS scheme and WebSocket upgrade headers to 127.0.0.1:8080. Do not register an OAuth callback for the internal port. The callback and every browser redirect must use the public HTTPS URL.
Deploy and connect the Docker runner
1. Start the runner with the Docker socket
The Docker runner needs access to the host Docker daemon so it can create step containers. On the same VPS, run:
docker run -d --name runner --restart=always -v /var/run/docker.sock:/var/run/docker.sock -e DRONE_RPC_PROTO=https -e DRONE_RPC_HOST=ci.example.com -e DRONE_RPC_SECRET=replace-with-random-secret -e DRONE_RUNNER_CAPACITY=2 -e DRONE_RUNNER_NAME=runner-1 drone/drone-runner-docker:1
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Use the same secret byte-for-byte as the server. Set DRONE_RPC_PROTO and DRONE_RPC_HOST to the route the runner actually uses to reach Drone. If a reverse proxy terminates TLS, that route is normally https plus the public hostname. The Docker runner supports Linux images on amd64, arm and arm64.
2. Set capacity to match concurrency
DRONE_RUNNER_CAPACITY is the number of pipelines that runner may execute concurrently. A value of 2 is only an example, not a universal recommendation. Raise it when the VPS has enough CPU, memory, storage I/O and network throughput for additional simultaneous builds; lower it when jobs contend for resources or the host begins swapping.
3. Confirm the RPC connection in logs
Run:
docker logs runner
Look for the message “successfully pinged the remote server”. This is the first connection check. If it is absent, inspect the hostname and protocol, confirm that the proxy forwards the request, compare the server and runner secrets, and check the firewall and DNS resolution from inside the runner container.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Enable repositories and run a first pipeline
Authorize Drone in the SCM provider
Open the Drone web interface at the public HTTPS hostname and sign in through the SCM provider. Approve the requested organization or repository scope. The OAuth callback must return to the exact host and path registered earlier; mismatches commonly produce redirect errors before a repository can be activated.
Activate a repository
In Drone’s repository list, enable the repository you want to build. Activation allows Drone to register webhooks and read the repository’s pipeline configuration. The server can queue work only after a repository is enabled and receives a qualifying event.
Add a minimal .drone.yml
Commit a pipeline file at the repository root to test the complete path from webhook to runner:
kind: pipeline
type: docker
name: default
steps:
- name: test
image: alpine:latest
commands:
- echo Drone runner is working
- uname -a
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Push the commit and watch the repository’s build page. The server should receive the webhook, queue the pipeline, the runner should claim it, and the Docker daemon should create the step container. This test deliberately uses a stateless command; add caches, services and credentials only after the basic path succeeds.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Reverse-proxy and HTTPS checks
- The DNS name in the browser, OAuth callback,
DRONE_SERVER_HOSTand (normally)DRONE_RPC_HOSTmust be consistent. - Use
httpsforDRONE_SERVER_PROTOwhenever the public URL is HTTPS, even if the proxy-to-container hop is HTTP. - Forward the original
Hostand HTTPS scheme. Incorrect forwarded headers can create HTTP redirects, rejected OAuth callbacks or links to an internal address. - Allow the proxy to pass WebSocket or connection-upgrade requests and use timeouts long enough for builds and live logs.
- Do not expose the Docker socket through the proxy or the public internet; it is mounted only into the runner container.
Persistence, security and routine operations
Protect the server data
Back up /var/lib/drone and test restoring it on a replacement VPS. The directory contains the server’s persistent state; a restart policy handles crashes, but it is not a backup. Keep backups separate from the VPS and restrict read access because they may contain repository and build metadata.
Protect credentials
- Store OAuth client secrets and
DRONE_RPC_SECREToutside Git repositories. - Limit who can read the Docker command, environment files and backup directory.
- Use a firewall to expose only SSH administration and the public web ports needed by your proxy or Drone.
- Patch Ubuntu, Docker and the Drone images on a planned schedule, and review runner logs after upgrades.
Understand Docker-runner isolation
Mounting /var/run/docker.sock gives the runner broad control of the host Docker daemon. Treat repository code and pipeline configuration as privileged workloads: restrict who can approve changes, avoid running untrusted repositories on the same runner, and separate sensitive builds onto a dedicated host when necessary.
Size the VPS from workload, not a published minimum
The reviewed Drone documentation does not define a universal CPU, RAM, disk or bandwidth minimum for an Ubuntu VPS. Choose capacity from the work you will run:
- Concurrency: estimate how many pipelines must run at once and set runner capacity accordingly.
- Build images: large images consume download bandwidth and local disk; frequent image changes increase startup time.
- Job profile: compilers, browsers, test databases and parallel test suites need more CPU and memory than short lint jobs.
- Repository volume and retention: account for checked-out sources, logs, caches and the amount of server data you retain.
- Storage I/O: concurrent image extraction and builds can make a fast CPU appear idle while the disk is saturated.
These are sizing criteria, not an official minimum. Start with measured workload demand, observe CPU, memory, disk and network during peak concurrency, then add runners or enlarge the VPS when queue time and resource contention grow.
Troubleshooting by symptom
The runner never reports a successful ping
- Run
docker logs runnerand confirm the error is not a DNS, TLS or authentication failure. - Verify
DRONE_RPC_HOSTis the externally reachable hostname andDRONE_RPC_PROTOmatches the public scheme. - Compare
DRONE_RPC_SECRETon server and runner without adding whitespace or changing capitalization. - From the VPS, test DNS resolution and outbound access to the proxy or Drone listener.
- If a proxy is involved, check its access log, forwarded host and scheme, and WebSocket handling.
OAuth login loops or is rejected
Compare the provider’s registered callback character-for-character with the URL users opened. Correct the scheme, hostname, port and provider-required path; then ensure DRONE_SERVER_HOST and DRONE_SERVER_PROTO describe that same public URL.
A build is queued but never starts
Confirm at least one runner is connected, its capacity is above zero, and the runner architecture can execute the pipeline’s Linux images. Inspect runner logs for Docker daemon errors and inspect server logs for repository or webhook failures.
Files disappear between pipeline executions
This is expected for Docker-runner steps: containers are ephemeral. Publish artifacts to an external store, use pipeline services designed for the job, or move the workload to an SSH or VM runner when it genuinely requires host-persistent files.
Recommended Free Tools
Scaling beyond one VPS
Keep the server’s persistent data on durable storage and add runners as queue time becomes the bottleneck. Multiple Docker runners can share the same RPC secret and server while using distinct names and capacities. A managed Docker or container platform can host additional runners when you need a build cluster, but the same rules still apply: stable external server settings, protected secrets, compatible architectures and monitoring of concurrent resource use.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
