Run ONLYOFFICE Docs in Docker on a Linux VPS, put it behind an HTTPS reverse proxy, and keep its data on host-mounted storage. For a small team, begin with at least 2 CPU cores, 4 GB RAM, 40 GB of free disk and 4 GB of swap; increase CPU, memory and storage as the number of people with documents open at the same time grows. Choose ONLYOFFICE Docs when an existing file platform already provides accounts and storage. Choose ONLYOFFICE Workspace when you need a broader, integrated collaboration environment.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Choose the right ONLYOFFICE product first
“ONLYOFFICE” can mean two different deployment decisions. Making that choice before ordering a VPS avoids paying for components you will not use or discovering that the editor has nowhere to store and share files.
As an Amazon Associate I earn from qualifying purchases.
ONLYOFFICE Docs
Docs is the editor service. It opens and converts word-processing documents, spreadsheets and presentations for another application. A portal such as Nextcloud supplies user accounts, file storage, sharing and permissions, while Docs supplies the editing engine. This is the usual choice when your team already has a file platform and you only need browser-based editing.
ONLYOFFICE Workspace
Workspace is the wider collaboration platform. Its deployment documentation covers Community and Enterprise editions on Docker, Linux and Windows. It is intended for teams that want an integrated environment rather than an editor attached to an existing portal. Edition limits, licensing and support terms can change, so check the current terms immediately before deployment.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
| Question | Choose Docs when… | Choose Workspace when… |
|---|---|---|
| Identity and accounts | Your existing portal already manages users and groups. | You want the collaboration suite to provide the account environment. |
| File storage | Your portal is the system of record for documents. | You want an integrated suite rather than a separate storage platform. |
| Architecture | One editor service is connected to one or more platforms. | You are deploying the broader platform and its supporting services. |
| Planning concern | Editor concurrency, conversion workload and connector compatibility. | All of those concerns plus the suite’s edition, licensing and support limits. |
The rest of this guide uses the Docker deployment of ONLYOFFICE Docs because it is the common VPS pattern. Apply the same principles—persistent host storage, HTTPS, JWT, backups and patching—to Workspace, while following its current installation instructions for the additional services.
Size the VPS for real editor concurrency
ONLYOFFICE counts a concurrent active user as someone who currently has a document open in the editor, whether that person is typing or merely viewing. Being logged into an integrated platform without an open document does not consume an active-editor slot in this definition.
| Concurrent active users | Reference CPU | Reference RAM | Reference disk | Deployment note |
|---|---|---|---|---|
| Fewer than 100 | Single core, 2.8 GHz | 4 GB | 40 GB | Reference configuration; leave additional headroom for the operating system and bursts. |
| 100–200 | Dual core, 2.8 GHz | 4 GB | 80 GB | Document size and conversion activity can require more resources. |
| 200–400 | Quad core, 2.8 GHz | 4 GB | 160 GB | Monitor CPU, memory, cache growth and latency rather than treating the table as a guarantee. |
| More than 400 | Not stated as a single-server reference | Not stated as a single-server reference | Not stated as a single-server reference | A cluster deployment is recommended. |
The basic Community Edition guidance also calls for a dual-core processor at 2 GHz or better, at least 4 GB of RAM, at least 40 GB of free disk and at least 4 GB of swap. The sizing table’s 2.8 GHz figures are reference points, not a promise that every workload will perform identically. Large files, frequent conversions, many simultaneous saves and other services sharing the VPS all increase demand.
Plan capacity beyond the minimum
- CPU: Conversion and rendering are bursty. Keep unused CPU capacity so a conversion spike does not make editing unresponsive.
- RAM and swap: Treat 4 GB RAM and 4 GB swap as a starting floor, not a target for a busy installation. Swap can prevent an abrupt out-of-memory kill, but it is not a substitute for adequate RAM.
- Disk: Reserve space for the operating system, mounted logs, document data, database state, temporary files and conversion cache. A 40 GB disk can fill quickly when documents and backups are retained on the same volume.
- Backups: Storage for backup archives is additional capacity unless you send archives to external backup or S3-compatible storage.
- Network: Editors transfer document content and collaboration traffic through the proxy. Select a VPS region close to users and check the provider’s bandwidth and egress limits.
Before ordering, decide your recovery objectives. A team that can tolerate a day of downtime can use a simpler schedule than one that needs a restore within an hour. Those objectives determine backup frequency, retention and whether a second VPS or external storage is warranted.
Prepare the Linux VPS and Docker
Use an amd64 or arm64 Linux VPS with a supported Docker Engine and Compose tooling if you prefer a compose file. Keep the host updated, set a hostname, configure time synchronization and create a non-root administrator account with controlled SSH access. The Docker management socket and database services should not be exposed to the public internet.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Open only the ports you need
- SSH: Permit it only from your administration addresses when practical, and use keys rather than password-only login.
- HTTP (80): Keep it available if you use it for ACME certificate validation or redirecting visitors to HTTPS.
- HTTPS (443): This is the normal public entry point.
- Everything else: Keep the document-server container’s internal port and any database port on the private Docker network. Do not publish Docker’s management interface.
Install Docker using the instructions for your Linux distribution, then confirm that the daemon starts on boot. A container restart policy helps after a host reboot, but it does not replace monitoring or a tested recovery procedure.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCreate persistent directories before starting the container
Container replacement is normal during upgrades. If logs, application data, cache or database state exist only inside the container, deleting that container can delete the information your installation needs. Create directories on the VPS and mount them into every replacement container.
sudo mkdir -p /srv/onlyoffice/{logs,data,lib,db}
sudo chown -R root:root /srv/onlyoffice
sudo chmod 700 /srv/onlyofficeThe exact ownership required by a particular image version can differ; correct it only as described by the image documentation after checking the container’s startup errors. The commonly used mounts are:
/srv/onlyoffice/logsto/var/log/onlyofficefor logs;/srv/onlyoffice/datato/var/www/onlyoffice/Datafor application data and certificates;/srv/onlyoffice/libto/var/lib/onlyofficefor service state and cache;/srv/onlyoffice/dbto/var/lib/postgresqlfor the bundled database state.
Keep these directories on a filesystem with enough free space and include all of them in the backup plan. Mounting only the document-data directory while omitting the database or cache state can leave an apparently intact installation unable to start cleanly after recreation.
Run ONLYOFFICE Docs with Docker
Pull the official onlyoffice/documentserver image and run it with a restart policy, persistent mounts and an explicit JWT secret. Use a long, random secret generated outside shell history, then store it in a root-readable environment file or secret manager.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
sudo docker run -d
--name onlyoffice
--restart=always
-p 127.0.0.1:8080:80
-e JWT_ENABLED=true
-e JWT_SECRET='replace-with-a-long-random-secret'
-v /srv/onlyoffice/logs:/var/log/onlyoffice
-v /srv/onlyoffice/data:/var/www/onlyoffice/Data
-v /srv/onlyoffice/lib:/var/lib/onlyoffice
-v /srv/onlyoffice/db:/var/lib/postgresql
onlyoffice/documentserverBinding the container to 127.0.0.1 keeps it reachable only through the local reverse proxy. If NGINX runs in another container, place both containers on a private Docker network instead of publishing the editor port publicly. Environment variable names and optional JWT settings can change with image releases; verify them against the current image documentation before deploying.
Verify the first start
- Check that Docker reports the container as running:
sudo docker ps. - Follow startup output:
sudo docker logs -f onlyoffice. The first launch can take several minutes while services initialize. - From the VPS, request the local endpoint:
curl -I http://127.0.0.1:8080/. A response confirms that the web service is answering locally. - Open the eventual public hostname only after the proxy and certificate are configured.
If startup fails, inspect the logs before changing settings. A port conflict, insufficient memory and first-time database initialization are common causes. Check ss -ltnp for a port already in use, check memory and swap with free -h, and allow initialization time before repeatedly recreating the container.
Put NGINX and HTTPS in front of the editor
Do not expose the document server directly to the internet. Point a DNS record such as docs.example.net at the VPS, terminate TLS in NGINX, and proxy requests to the local container. A certificate authority certificate is the normal choice. Let’s Encrypt automation is suitable for public names; a self-signed certificate is appropriate only when every client explicitly trusts your private certificate authority.
Minimal NGINX reverse-proxy configuration
server {
listen 80;
server_name docs.example.net;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl http2;
server_name docs.example.net;
ssl_certificate /etc/letsencrypt/live/docs.example.net/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/docs.example.net/privkey.pem;
client_max_body_size 200m;
proxy_read_timeout 3600s;
proxy_send_timeout 3600s;
location / {
proxy_pass http://127.0.0.1:8080;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
}The forwarded protocol and host headers are essential when TLS ends at NGINX. They tell ONLYOFFICE that the original request was HTTPS and identify the public hostname, preventing incorrect callback URLs and mixed-content behavior. WebSocket upgrade headers support live editor communication. Adjust the body-size and timeout values to your document sizes and network conditions; do not copy a limit without considering your workload.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsValidate the configuration with sudo nginx -t, reload NGINX, and test the certificate from a client outside the VPS. Keep private-key files readable only by the account and services that need them. Renew certificates before expiry and test renewal rather than assuming automation works.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Connect Docs to Nextcloud or another storage platform
The storage platform must be able to reach the public Docs hostname over HTTPS, and Docs must be able to reach the platform’s callback and download endpoints. In the platform’s office or editor settings, enter the HTTPS URL of your document server, not the container’s private address. Use the connector’s JWT option and enter the same deliberate secret configured in the container.
- Confirm that the platform and the VPS resolve each other’s public DNS names correctly.
- Install or enable the platform’s ONLYOFFICE integration according to its current administration interface.
- Set the document-server URL to
https://docs.example.net/(use the exact path required by the connector). - Enable JWT in the integration and paste the identical secret; avoid trailing spaces or line breaks.
- Save the configuration and use the platform’s built-in connection test if available.
- Open a small document, edit it, save it, close it and reopen it. Test a spreadsheet and presentation as well as a text document.
JWT protects editor requests from unauthorized access. If the platform reports signature or authorization errors, compare the secret byte-for-byte on both sides, verify that the container was recreated after changing its environment, and inspect proxy logs for requests reaching the wrong hostname.
Back up mounted data before every update
Host mounts make upgrades safer, but they do not create backups. Before changing the image, stop writes where your platform permits, archive the mounted directories, and copy the archive to storage outside the VPS. Retain multiple generations so a bad update is not your only recovery point.
sudo tar -czf /backup/onlyoffice-$(date +%F).tgz
/srv/onlyoffice/logs
/srv/onlyoffice/data
/srv/onlyoffice/lib
/srv/onlyoffice/dbProtect backup archives because they can contain documents, metadata, logs and secrets. Encrypt them in transit and at rest, restrict access, and record retention. A backup is credible only after a restore test: periodically provision a temporary VPS, restore the directories, start the documented image and verify that an editor can open and save a test file.
Safe image-update sequence
- Read the release notes and confirm that the target image is compatible with your integration.
- Make and verify the external archive of every mounted path.
- Pull the new image:
sudo docker pull onlyoffice/documentserver. - Record the current container configuration with
sudo docker inspect onlyoffice. - Stop and remove the old container without deleting the host directories.
- Recreate it with the identical mounts, port binding, restart policy and JWT settings.
- Watch logs, check the welcome endpoint and run an end-to-end edit/save test through the storage platform.
- Keep the previous image available until the new version has passed your checks; remove old images only after the rollback window.
Changing the JWT secret is a coordinated migration: update the integration and recreate the container with the new value during a planned maintenance window. A generated secret that changes after a reboot can break integrations, which is why a deliberate persistent secret is preferable.
Operate the service securely
- Patch: Track Docker image releases, the Linux host, NGINX and the storage platform. Schedule maintenance and document the rollback image.
- Monitor: Alert on container restarts, sustained CPU or memory pressure, disk usage, certificate expiry, failed health checks and backup failures.
- Control access: Use the storage platform’s groups and least-privilege roles. Keep administration interfaces private and review inactive accounts.
- Protect secrets: Store JWT and TLS private keys with owner-only permissions where possible. Never commit them to a public repository or paste them into support tickets.
- Separate networks: Keep databases and Docker management off public interfaces. Use firewall rules and private Docker networks.
- Plan incidents: Write down who can revoke access, rotate JWT, restore data, renew certificates and communicate an outage.
Self-hosting keeps documents, user data, metadata and audit logs in infrastructure selected by your organization. It also makes your organization responsible for patching, backups, monitoring, account lifecycle and incident response. Open-source availability under AGPL v3 permits users and contributors to read, run and modify the core products, but obligations depend on how you integrate and distribute the software; obtain legal advice for commercial redistribution.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Troubleshoot the failures teams see most often
The page does not load
Confirm DNS points to the VPS, TCP 443 is allowed, NGINX is running and the certificate matches the hostname. From the host, test the private endpoint. If that works but the public URL fails, inspect NGINX’s error log and firewall rules rather than changing the container.
NGINX returns 502 Bad Gateway
Check that the container is running and that NGINX’s upstream address matches the published binding. A proxy in a separate container cannot use 127.0.0.1 to reach the host’s other container; use a shared Docker network and the service name, or publish the port on the host deliberately.
The integration reports an invalid token
Compare JWT settings on the platform and container, remove accidental whitespace, and recreate the container after changing environment variables. Verify that the proxy forwards the original host and HTTPS scheme and that no second proxy is rewriting authorization headers.
Edits are slow or the container stops
Check memory, swap, CPU saturation and free disk while a document is open. Conversion-heavy workloads may need more CPU; a growing cache or log directory may need cleanup according to the product’s documented procedure. Do not simply increase swap while leaving the VPS out of RAM.
Free tools Windows power users keep installed
One-click scans. No signup required.
Data disappeared after an upgrade
Stop and inspect the container’s mount list. If a path was omitted or mapped to a new empty host directory, restore the correct archive, recreate the container with the original mappings and verify the database and application-data paths before allowing users back in.
A practical launch checklist
- Product choice recorded: Docs with an existing portal, or Workspace for the integrated suite.
- Linux amd64 or arm64 VPS provisioned with Docker.
- At least 4 GB RAM, 40 GB free disk and 4 GB swap for the basic starting point, with concurrency headroom.
- Host directories created for logs, application data, cache or service state, and database state.
- Container uses
--restart=always, persistent mounts and a deliberate JWT secret. - DNS, HTTPS certificate and reverse proxy configured.
X-Forwarded-ProtoandX-Forwarded-Hostforwarded correctly.- Storage-platform connector tested with text, spreadsheet and presentation files.
- Firewall exposes only required web and administration access.
- External backups, retention and a restore test documented.
- Monitoring, patch schedule and rollback procedure assigned to an owner.
The Bottom Line
A dependable ONLYOFFICE VPS is less about launching one container than operating a small service: select Docs or Workspace deliberately, size for people with documents open, persist every required data path, terminate HTTPS at a correctly configured proxy, keep JWT enabled, and prove that backups restore before an update makes the decision for you.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
