The dependable way to self-host Stirling PDF is to run its official Docker image with Docker Compose, keep /configs and /storage on persistent VPS storage, and expose it through an HTTPS reverse proxy. Use the standard image on a VPS with at least 4 GB of RAM, keep login protection enabled, pin a tested image tag for upgrades, and back up the persistent directories before changing versions.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What the finished deployment looks like
Your VPS runs one or more Stirling PDF containers on a private Docker or loopback interface. Nginx (or another reverse proxy) is the only public entry point, terminating HTTPS and forwarding requests to Stirling PDF on port 8080. Docker volumes keep settings, the embedded database, generated keys, uploaded files, logs, branding files, pipeline folders, and optional OCR data outside the container filesystem.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteThis arrangement gives you controlled upgrades and a clear security boundary: the web service is reachable through HTTPS, while the container port and any optional AI-engine port remain private. The official Docker documentation describes Docker as the recommended way to run a Stirling PDF server (accessed 2026).
Choose the right Stirling PDF image and VPS size
Stirling PDF publishes images for both amd64 and arm64. Select the image according to the conversions and memory available on your host. The figures below are operational recommendations from the current official Docker documentation, not independent benchmark results.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
| Image tag | What it includes | Suggested memory | When to choose it |
|---|---|---|---|
latest |
Broad standard feature set | 4 GB | Default choice for most personal and small-team VPS deployments |
latest-fat |
Bundled AI engine and additional tools | About 6 GB, with more needed when AI is enabled | Hosts that need the extra conversion tools or local AI features |
latest-ultra-lite |
Core PDF tools with fewer conversion dependencies | 2 GB | Constrained VPSs where the omitted dependencies are acceptable |
These are suggested memory levels, not hard limits. Large PDFs, OCR, image-heavy documents, concurrent users, and AI processing can require more headroom. Leave memory for the operating system, Docker, Nginx, and monitoring instead of allocating every available megabyte to the container.
What to compare when selecting a VPS
- Docker Engine and the Docker Compose plugin must be supported.
- RAM should match the selected image: plan around 4 GB for the standard image, approximately 6 GB for the fat image, or 2 GB for ultra-lite before accounting for workload overhead.
- Use persistent SSD storage with a backup or snapshot facility. PDF uploads and generated files can consume more disk than the application itself.
- Make it possible to expose only the reverse proxy publicly. Port 8080 and an AI-engine port, if used, should be restricted by binding and firewall rules.
- Check IPv4/IPv6 support, firewall controls, DNS and TLS integration, region, bandwidth policy, recovery procedures, and whether the VPS can be resized later.
Prepare the VPS
Install Docker and Compose
Install Docker Engine and the Docker Compose plugin using the package instructions for your VPS operating system. Verify both components before creating the application:
Free tools Windows power users keep installed
One-click scans. No signup required.
docker --version
docker compose versionRun the commands below as a user allowed to access Docker, or prefix them with sudo when your host requires it. Keep the VPS firewall closed to all ports except SSH and the HTTPS endpoint you intend to publish. Do not open 8080 merely because the container listens on it internally.
Create an application directory
Use a dedicated directory so compose files, persistent data, and backups have an obvious boundary:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
sudo mkdir -p /opt/stirling-pdf/{configs,storage,logs,customFiles,pipeline,tessdata}
sudo chown -R 1000:1000 /opt/stirling-pdfThe container runs as UID and GID 1000 by default. If your host storage uses different ownership, either adjust the directory ownership or set matching PUID and PGID values in Compose. Incorrect ownership is a common cause of startup and upload failures.
Create the Docker Compose deployment
Save the following as /opt/stirling-pdf/docker-compose.yml. It uses the standard image, binds the application only to loopback, and persists every directory that the server documentation identifies as useful. The latest tag is convenient for the first launch; for production, replace it with a specific version tag after you have chosen an upgrade policy.
services:
stirling-pdf:
image: docker.stirlingpdf.com/stirlingtools/stirling-pdf:latest
container_name: stirling-pdf
restart: unless-stopped
ports:
- '127.0.0.1:8080:8080'
environment:
SECURITY_ENABLELOGIN: 'true'
PUID: '1000'
PGID: '1000'
volumes:
- ./configs:/configs
- ./storage:/storage
- ./logs:/logs
- ./customFiles:/customFiles
- ./pipeline:/pipeline
- ./tessdata:/usr/share/tessdata
mem_limit: 4gThe memory limit is a starting point for the standard image, not a universal requirement. Remove or change it if your capacity plan calls for a different limit, and size the host according to the selected image and workload. For latest-fat, change the image tag and plan for approximately 6 GB or more when the AI engine is active. For latest-ultra-lite, use its tag when the reduced dependency set is sufficient for your documents.
Why each mount matters
/configs: stores settings, the built-in database, backups, and generated keys. Losing it can remove accounts and configuration, so it is the first directory to back up before a major upgrade./storage: holds server-side file storage, which is enabled by default. Without this mount, files stored inside the container can disappear when the container is replaced./logs: keeps logs outside the container so they remain available for diagnosis and rotation./customFiles: stores branding or signature files that you want to survive image changes./pipeline: provides watched and finished folders for automated pipeline workflows./usr/share/tessdata: lets you add OCR language data beyond what is included in the image. Leave the mount out if you do not need additional languages.
If you use a different host directory, preserve the container-side paths exactly. Stirling PDF expects these paths inside the container.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Start the service and secure the first login
- Change to the application directory:
cd /opt/stirling-pdf. - Validate the Compose file:
docker compose config. Fix indentation or path errors before starting. - Start the container in the background:
docker compose up -d. - Check its state:
docker compose ps. - Inspect startup messages if needed:
docker compose logs -f stirling-pdf. - From the VPS itself, test the private listener with
curl -I http://127.0.0.1:8080. A response confirms that Docker is listening; the exact HTTP status can vary during initialization.
Open the service through the reverse proxy once HTTPS is configured. Complete the first sign-in immediately, replace the initial administrator password with a long unique password, and keep SECURITY_ENABLELOGIN=true. The production checklist for Stirling PDF specifically recommends leaving login protection at its default of true. A public VPS should never rely on an unprotected installation.
Put Stirling PDF behind Nginx and HTTPS
Terminate TLS at Nginx and proxy to the loopback address. Obtain and install a certificate for the hostname through your normal certificate-management process, then adapt the certificate paths in the example below. The values for upload size and timeouts mirror the production example in the official documentation and should be treated as starting points.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →server {
listen 80;
server_name pdf.example.com;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl;
server_name pdf.example.com;
ssl_certificate /etc/ssl/pdf.example.com/fullchain.pem;
ssl_certificate_key /etc/ssl/pdf.example.com/privkey.pem;
client_max_body_size 2000M;
location / {
proxy_pass http://127.0.0.1:8080;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Port $server_port;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_buffering off;
proxy_read_timeout 1800s;
proxy_send_timeout 1800s;
}
}Replace pdf.example.com and the certificate paths with your own hostname and files. The important application-facing headers are Host, X-Forwarded-Proto, X-Forwarded-Host, X-Forwarded-Port, and X-Forwarded-For. Without them, generated links or redirects can point to the wrong scheme or host.
Why the proxy limits matter
client_max_body_size 2000Mprevents Nginx from rejecting large PDFs before Stirling PDF receives them. Lower it when your policy or disk capacity requires a smaller maximum.proxy_buffering offavoids buffering long-running conversion responses in Nginx.proxy_read_timeout 1800sandproxy_send_timeout 1800sallow up to 30 minutes for slow uploads or intensive processing. Shorter values can terminate legitimate OCR or conversion jobs; longer values keep connections open and consume more proxy resources.
After enabling the site, validate the Nginx configuration, reload Nginx, and test both a small PDF and a deliberately larger file within your chosen limit. HTTPS should be the only public route to the application; keep the loopback binding on port 8080.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Use a sub-path instead of a dedicated hostname
A dedicated hostname such as pdf.example.com is usually simpler. If the application must live under a path such as https://example.com/pdf, set SYSTEM_ROOTURIPATH=/pdf and configure Stirling PDF’s system.frontendUrl with the complete public URL, including the path. This allows email links, share links, and QR codes to include /pdf rather than pointing at the site root.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Configure the reverse proxy’s location block consistently with that path and preserve the forwarded headers. Test navigation, downloads, generated links, and QR codes; a deployment that loads the home page but emits root-level links is not correctly configured for a sub-path.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Optional AI engine: keep it private
The fat image includes a bundled AI engine and additional tools, but enabling AI changes the security and memory profile. Do not publish port 5001 and do not route it through the public reverse proxy. Keep the engine on the private Docker network or loopback interface.
Set a long, random STIRLING_ENGINE_SHARED_SECRET on both the Stirling PDF service and the engine, and enable STIRLING_ENGINE_REQUIRE_AUTH=true on the engine. Store the secret securely rather than committing it to a public Compose file. If AI requests fail, first check that both services use the identical secret, that the engine is reachable over the private network, and that no firewall rule has exposed port 5001.
Back up data and upgrade safely
What to back up
Back up /configs before every major upgrade. It contains the built-in database, settings, backups, and generated keys. Also back up /storage if server-side files must be recoverable, plus /customFiles, /pipeline, and any extra OCR data that you cannot easily recreate. A VPS snapshot is useful, but keep an application-level copy that can be restored independently of the provider.
Stop or quiesce high-volume processing before taking a consistent backup. Preserve ownership and permissions when copying the directories, and periodically test a restore on a separate path or disposable host.
Pin a version instead of following latest
The latest tag can move as new releases are published. For controlled production changes, replace it with a specific Stirling PDF version tag, record the currently running tag, and upgrade deliberately. Pinning makes rollback possible and lets you schedule a maintenance window.
- Back up
configsand the other persistent directories. - Change the
imageline indocker-compose.ymlto the selected version tag. - Pull the image:
docker compose pull. - Recreate the container:
docker compose up -d. - Review startup output with
docker compose logs --tail=200 stirling-pdf. - Sign in, open representative tools, process a test PDF, and confirm that stored files, branding, pipelines, and OCR languages remain available.
If the new version fails, stop the service, restore the previous image tag, and recreate the container using the backup you made before the change. Do not delete the persistent directories while troubleshooting; doing so destroys the very data needed for rollback.
Troubleshooting common VPS failures
| Symptom | Likely cause | Checks and fix |
|---|---|---|
| Nginx returns 502 | The container is stopped, port binding is wrong, or Nginx cannot reach loopback. | Run docker compose ps, inspect docker compose logs, and test curl http://127.0.0.1:8080 on the VPS. Confirm Nginx uses the same address and port. |
| Upload rejected before processing | Nginx’s body limit is smaller than the PDF. | Raise or lower client_max_body_size deliberately, reload Nginx, and ensure the VPS has enough disk space for the upload and generated output. |
| Long conversion ends with a gateway timeout | Proxy read or send timeout is too short. | Use the 1800-second starting values, then adjust to the longest legitimate job and your operational policy. |
| Settings or files disappear after recreation | The relevant container directories were not mounted. | Confirm mounts for /configs and /storage, then add /customFiles, /pipeline, or /usr/share/tessdata when those features are used. |
| Permission denied in logs or uploads | Host directories are not writable by the container’s UID/GID. | Match ownership to UID/GID 1000 or set PUID and PGID to the host account that owns the directories. |
| Container is killed or the host swaps heavily | The image or workload exceeds available memory. | Check host memory and container events, reduce concurrency, move from fat to standard only if its features are sufficient, or resize the VPS. Ultra-lite uses fewer conversion dependencies but may not support every workflow you need. |
| OCR language is unavailable | The language data is not present in the image or mounted directory. | Place the additional language files in the host directory mounted at /usr/share/tessdata, then restart the container if required by the image. |
| Links contain the wrong scheme or host | Forwarded headers or the public URL are missing. | Pass all documented X-Forwarded-* headers and set system.frontendUrl when using a sub-path or a non-default public URL. |
| AI requests fail | The engine is unreachable, the shared secret differs, or authentication is disabled. | Keep port 5001 private, compare STIRLING_ENGINE_SHARED_SECRET on both services, and set STIRLING_ENGINE_REQUIRE_AUTH=true on the engine. |
Production readiness checklist
- Docker Engine and Compose are installed and verified.
- The image tag matches the VPS memory plan and CPU architecture.
/configsand/storageare persistent; other used directories are mounted as well.- Host ownership matches UID/GID 1000, or
PUID/PGIDare explicitly set. - The initial administrator password has been replaced.
SECURITY_ENABLELOGIN=trueremains enabled.- Only Nginx or another HTTPS reverse proxy is publicly reachable; 8080 is loopback-only.
- Nginx forwards the documented host and forwarded-protocol headers.
- Upload size and processing timeouts match your policy and document sizes.
- Port 5001 is private whenever the optional AI engine is enabled.
/configsis backed up before major upgrades, with restore tests performed periodically.- Production upgrades use a pinned image tag and a documented rollback path.
How to choose between the three images
Choose latest when you want the broad standard feature set and can provide roughly 4 GB of memory. Choose latest-fat when its bundled AI engine and extra tools justify approximately 6 GB or more and you will keep the engine private. Choose latest-ultra-lite for a 2 GB host only after confirming that your workflows do not require the conversion dependencies it omits. In every case, workload size, concurrent processing, OCR, and AI can increase the required memory beyond the documentation’s starting recommendation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
