The production pattern is straightforward: run the official metabase/metabase image on a Linux VPS, store Metabase’s application state in PostgreSQL, keep the container’s port 3000 private, and terminate HTTPS at a reverse proxy. The embedded H2 database is suitable for a disposable trial, not a production installation.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
This guide covers the VPS layout, PostgreSQL configuration, Docker Compose, secrets, first startup, HTTPS, backups, upgrades, and the failure modes most likely to interrupt a deployment.
As an Amazon Associate I earn from qualifying purchases.
What the production architecture looks like
A self-hosted installation has four separate concerns:
- VPS: a current Linux server with a public IP, DNS name, firewall, Docker Engine, and Docker Compose.
- Metabase: the official
metabase/metabasecontainer, listening on port 3000 inside the server. - Application database: PostgreSQL, used for Metabase users, questions, dashboards, permissions, settings, and other application metadata.
- Reverse proxy: a web server or load balancer that owns the public hostname, serves HTTPS, and forwards requests to Metabase.
Browser traffic should follow this path:
Browser → HTTPS reverse proxy → private Metabase port 3000 → PostgreSQL application database
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Metabase can also connect to separate databases as data sources. Those source databases are not the same thing as Metabase’s application database. Keep the application database persistent even if all analytical data lives elsewhere.
Metabase documents its official Docker image as usable on any system running Docker and recommends putting Metabase behind a reverse proxy or load balancer rather than exposing its port directly to the internet.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Before you deploy
VPS and operating-system requirements
Use a currently supported Linux distribution, apply its security updates, and assign the server a stable public IP. Create a DNS record such as analytics.example.com pointing to that address. There is no universal VPS size or price for Metabase: the right resources depend on concurrent users, dashboard complexity, query workloads, caching, and the databases being queried. Treat sizing as a workload decision rather than relying on a generic benchmark.
Install Docker Engine and the Docker Compose plugin from the operating system or Docker’s supported packages. Confirm both commands before continuing:
docker --version
docker compose versionNetwork and firewall plan
Plan to expose only the ports you actually need. A typical public deployment allows SSH for administration and TCP 443 for HTTPS. Port 80 may be opened temporarily or kept available for an HTTP-to-HTTPS redirect, depending on how certificates are issued. Do not leave Metabase’s 3000/tcp reachable from the public internet.
Choose PostgreSQL before starting Metabase
Create an empty PostgreSQL database and a login role for Metabase. No Metabase tables need to be created manually; Metabase creates its application tables during startup. PostgreSQL can run on the same VPS with persistent storage or on a managed database service. A managed service reduces database maintenance, but you still own the Metabase configuration, access controls, and recovery plan.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Why embedded H2 is not a production database
The quick-start container can start with an embedded H2 database, which is convenient for evaluating the interface. H2 stores Metabase’s application state inside the container’s writable layer. If that container is deleted without an export or migration, the Metabase application data disappears with it.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Production deployments should set MB_DB_TYPE=postgres and provide PostgreSQL connection details. This separates the application state from the disposable container and makes normal database backup and restore procedures possible. A PostgreSQL database used by Metabase is not a replacement for backups: it must still be backed up regularly and restored in a test environment.
Create a private project and protect credentials
Work in a directory that is not shared with other applications. The following commands create a project and a directory for Docker secret files:
sudo mkdir -p /opt/metabase/secrets
sudo chown -R "$USER":"$USER" /opt/metabase
cd /opt/metabase
umask 077
touch secrets/db_user.txt secrets/db_password.txtEdit the two files with the PostgreSQL role name and password using a password manager or another controlled method. Keep the directory out of source control and restrict its permissions. Do not commit passwords to a Compose file, shell history, or a public repository.
Docker supports secret-file variants for the Metabase database variables. In the Compose example below, the username and password are read from files mounted at /run/secrets, while the non-sensitive connection settings remain ordinary environment variables.
Compose configuration for Metabase and PostgreSQL
Create /opt/metabase/compose.yml with a configuration like this:
services:
metabase:
image: metabase/metabase:latest
restart: unless-stopped
ports:
- '127.0.0.1:3000:3000'
environment:
MB_DB_TYPE: postgres
MB_DB_DBNAME: metabaseappdb
MB_DB_PORT: '5432'
MB_DB_HOST: db.internal.example
MB_DB_USER_FILE: /run/secrets/db_user
MB_DB_PASS_FILE: /run/secrets/db_password
MB_SITE_URL: https://analytics.example.com
MB_REDIRECT_ALL_REQUESTS_TO_HTTPS: 'true'
secrets:
- db_user
- db_password
networks:
- metabase_private
healthcheck:
test: ['CMD-SHELL', 'curl --fail http://localhost:3000/api/health || exit 1']
interval: 30s
timeout: 10s
retries: 5
start_period: 60s
secrets:
db_user:
file: ./secrets/db_user.txt
db_password:
file: ./secrets/db_password.txt
networks:
metabase_private:
driver: bridgeReplace db.internal.example with the hostname or private address of your PostgreSQL server and replace analytics.example.com with the DNS name you will publish. The 127.0.0.1:3000:3000 mapping binds the service only to the VPS loopback interface, so a reverse proxy running on that host can reach it while the public network cannot. If your proxy runs in another container, attach both containers to a private Docker network and avoid publishing port 3000 at all.
The quick-start image uses the latest tag for convenience. For production change control, replace it with a specific Metabase release tag that you have tested, record the current tag, and review release notes before changing it.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesRank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
If PostgreSQL is also containerized, place its service on metabase_private, store its data on a persistent volume, and set MB_DB_HOST to the PostgreSQL service name. If PostgreSQL is managed elsewhere, restrict its network access to the VPS and use the provider’s TLS and certificate instructions.
Start the container and complete first-run setup
- From the project directory, validate the Compose file:
docker compose config - Pull the image and start it in the background:
docker compose pull
docker compose up -d - Follow startup messages while Metabase connects to PostgreSQL and creates its tables:
docker compose logs -f metabase - Check the local health endpoint from the VPS:
curl --fail http://127.0.0.1:3000/api/healthA successful HTTP response indicates that the application is answering requests. An unsuccessful response means you should inspect the logs before configuring the proxy.
- Open the site through the reverse proxy hostname and complete Metabase’s first-run setup in the browser. Do this only after the application database connection succeeds.
Metabase’s initial schema creation can take longer than a normal restart, especially on a small or distant database server. Do not repeatedly delete and recreate the container while it is initializing; that can make diagnosis harder.
Put Metabase behind HTTPS
The reverse proxy should be the only public entry point. It obtains and renews the certificate according to your certificate authority’s process, accepts HTTPS, and forwards the request to the private Metabase listener.
A generic Nginx-style configuration looks like this; adapt certificate paths and service management to the proxy you operate:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
server {
listen 80;
server_name analytics.example.com;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl;
server_name analytics.example.com;
ssl_certificate /etc/ssl/analytics/fullchain.pem;
ssl_certificate_key /etc/ssl/analytics/privkey.pem;
location / {
proxy_pass http://127.0.0.1:3000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
}
}Set MB_SITE_URL to the complete HTTPS origin, including the hostname, and set MB_REDIRECT_ALL_REQUESTS_TO_HTTPS=true when TLS terminates at the proxy. The proxy must send X-Forwarded-Proto: https; otherwise Metabase can misidentify secure requests and create redirect loops. Reload the proxy, then test the public hostname from a separate machine.
Keep the direct port-3000 binding limited to loopback or an internal network. A reverse proxy is not a substitute for a firewall rule: enforce the restriction at both layers.
Secure PostgreSQL and data-source connections
Use TLS for the PostgreSQL application connection and for connected data sources whenever the database service supports it. Follow the database provider’s certificate-validation instructions rather than disabling verification.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
The Metabase Docker image includes AWS and Azure certificate authorities under /app/certs/. Connections to other providers may require a custom image or mounted certificate files. Confirm the required certificate location and connection parameters with the database provider, then test the connection from the running Metabase container.
Database credentials should remain in Docker Secrets or an equivalent secret manager. The database hostname, database name, and port are not passwords, but they can still reveal infrastructure details; keep the Compose project private and limit who can read it.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Backups, restoration, and routine operations
Back up the application database
Back up the PostgreSQL database that stores Metabase’s application state, not just the analytical databases Metabase queries. The exact schedule should match how much configuration loss your organization can tolerate. Keep backups outside the VPS so a disk failure or server compromise does not destroy both the live database and its copies.
For a self-managed PostgreSQL server, a custom-format dump is a practical starting point:
Free tools Windows power users keep installed
One-click scans. No signup required.
mkdir -p /var/backups/metabase
pg_dump --format=custom --file=/var/backups/metabase/metabaseappdb-$(date +%F).dump --dbname=metabaseappdb --host=db.internal.example --username=metabaseUse a protected password mechanism such as a PostgreSQL password file or your provider’s secret integration; do not put the password directly in the command line. Managed PostgreSQL services generally provide their own scheduled backup and point-in-time recovery controls, but you should still understand how to export and restore a copy.
Test a restore
A backup is useful only if it can be restored. Periodically restore a dump into an isolated PostgreSQL database, point a temporary Metabase instance at it, and verify that you can sign in and open representative dashboards. A restore test also exposes missing extensions, certificate files, network rules, or secret values before an emergency.
Apply operating-system and container updates
Keep the VPS operating system, Docker Engine, reverse proxy, and Metabase image under change control. Before an upgrade:
- Confirm that a recent PostgreSQL backup exists and that a restore test has passed.
- Record the currently running Metabase image tag and Compose configuration.
- Review the release notes for compatibility or migration warnings.
- Have the previous image tag and a database recovery procedure ready in case a rollback is needed.
Do not treat latest as an immutable production release reference. Pin a tested tag, update deliberately, and retain the previous tag until the new deployment is verified.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Deployment choices: Docker on a VPS or Metabase Cloud
Metabase presents Cloud as the easiest operational option, while Docker is the documented route for organizations that want to self-host. The decision is less about the dashboard interface than about who owns infrastructure and recovery work.
| Consideration | Docker on a VPS | Metabase Cloud |
|---|---|---|
| Operational effort | You maintain the VPS, Docker, PostgreSQL, proxy, firewall, certificates, monitoring, and backups. | The service operator handles the hosting layer and much of the platform maintenance. |
| Control and data residency | You choose the server location, network boundaries, image tag, and database placement. | You accept the service’s hosting, tenancy, and data-residency model. |
| Recurring infrastructure cost | You pay for the VPS and PostgreSQL capacity; the amount depends on workload and provider. | You pay the applicable hosted-service plan rather than running these components yourself. |
| Backup responsibility | You must schedule PostgreSQL backups and prove that restoration works. | Backup capabilities and responsibilities follow the hosted service’s terms. |
| TLS and networking | You configure DNS, certificates, firewall rules, and the reverse proxy. | The hosted service supplies the public endpoint and its associated network controls. |
| Upgrade and rollback ownership | You choose when to change image tags and must retain a rollback plan. | The service operator controls platform upgrades, subject to the service’s release process. |
Troubleshooting the common failures
Metabase restarts or never becomes healthy
Read the container log first:
docker compose logs --tail=200 metabaseCheck the PostgreSQL hostname, port, firewall rule, database name, and secret-file permissions. Confirm that the database role can log in from the VPS and that the database accepts TLS settings required by its provider. If the log shows authentication failure, verify the contents and line endings of the mounted secret files.
The proxy returns 502 or connection refused
Test the application locally on the VPS with curl --fail http://127.0.0.1:3000/api/health. If that fails, the issue is inside Docker or PostgreSQL rather than in the proxy. If it succeeds, verify that the proxy’s upstream address matches the published binding, that the proxy can reach the loopback address, and that the firewall is not blocking an internal-container path.
HTTPS redirects repeatedly
Ensure the public URL in MB_SITE_URL starts with https://, confirm that MB_REDIRECT_ALL_REQUESTS_TO_HTTPS is enabled only when TLS really terminates at the proxy, and pass X-Forwarded-Proto: https. A proxy that forwards every request as HTTP can trigger an endless redirect.
Recommended Free Tools
Users can reach port 3000 directly
Change the Compose binding to 127.0.0.1:3000:3000 or remove the host port and use a private Docker network. Then remove any public firewall rule for 3000 and retest from an external network.
Application data vanished after a redeploy
This usually indicates that Metabase was using embedded H2 or that PostgreSQL storage was not persistent. Configure the PostgreSQL application database before entering production data, verify that the database survives container recreation, and restore from a known backup if one exists.
A managed database rejects the certificate
Use the provider’s CA certificate and validation parameters. AWS and Azure CA files are included in the image under /app/certs/; another provider may require mounted certificate files or a custom Metabase image. Do not solve certificate errors by disabling validation on a production connection.
Production readiness checklist
- Metabase runs from a pinned, reviewed image tag rather than an unexamined moving tag.
MB_DB_TYPE=postgresis configured, and the PostgreSQL database is persistent.- Database credentials are supplied through Docker Secrets or an equivalent secret manager.
- Port 3000 is private and unreachable from the public internet.
- The reverse proxy serves the canonical HTTPS hostname and forwards the correct host and protocol headers.
MB_SITE_URLmatches that HTTPS hostname, with HTTPS redirection enabled when appropriate.- PostgreSQL and connected data sources use certificate validation where supported.
- Operating-system, Docker, proxy, and Metabase updates are planned and reversible.
- PostgreSQL backups run regularly, are stored separately, and have been restored successfully in a test environment.
The practical answer
For a production VPS deployment, use the official Metabase image with PostgreSQL as the application database, keep secrets outside the Compose file, bind Metabase privately, and put a TLS-terminating reverse proxy in front of it. The remaining work is operational: firewall the server, back up and test restoration of PostgreSQL, and upgrade by pinned image tags with a rollback plan.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
