Hosting PocketBase on a VPS: complete guide

PocketBase is an open source backend-as-a-service distributed as a single binary: no separate Postgres, no Redis, no complex stack to orchestrate. Everything runs on SQLite, making it perfectly suited to an entry-level VPS.

By self-hosting, you retain full control over your user data and files, without depending on a managed Firebase or Supabase with quotas and latency that can be problematic depending on your region. A VPS gives you a fixed IP, a custom domain and backups that you fully control.

Because PocketBase writes to a single pb_data folder, your backup strategy comes down to copying that directory, which simplifies operations enormously compared to a classic database cluster. You can migrate your backend by moving a single folder.

PocketBase is extremely lightweight. Here is what you need based on your load:

Absolute minimum: 1 vCPU, 512 MB of RAM. Sufficient for a development project or a small application with fewer than 1,000 active users.

Recommended in production: 1 vCPU, 1 GB of RAM. PocketBase handles a small to medium-sized project easily with this configuration; the SQLite cache and real-time traffic spikes are absorbed comfortably.

For high volumes: 2 vCPU, 2 GB of RAM. The limit of PocketBase is usually concurrent writes to SQLite, not CPU.

For storage, plan for 20 to 40 GB SSD NVMe depending on the volume of files uploaded by your users. Since SQLite is a single file, an NVMe disk noticeably improves concurrent write performance — avoid network drives (NFS, CIFS) which can corrupt the database when locks are mishandled.

Required software: Docker 24+ and Docker Compose v2 (or the PocketBase binary alone with systemd), a domain name or subdomain pointing to the VPS IP via an A record, a reverse proxy (Caddy, Nginx or Traefik) to handle TLS.

PocketBase natively supports OAuth2 with several providers: Google, GitHub, GitLab, Discord, Twitter/X, Microsoft, Apple and others. Configuration is done entirely from the admin interface, without touching code.

For Google OAuth:
1. Open the Google Cloud Console, create a project and enable the "OAuth consent screen" API.
2. Under "Credentials", create an "OAuth 2.0 Client ID" of type "Web application".
3. Add https://app.your-domain.com/api/oauth2-redirect as an authorized redirect URI.
4. Copy the Client ID and Client secret.
5. In PocketBase /_/, go to Settings → Auth providers → Google, enable it and paste your credentials.

For GitHub OAuth:
1. On GitHub, go to Settings → Developer settings → OAuth Apps → New OAuth App.
2. Set https://app.your-domain.com as the Homepage URL and https://app.your-domain.com/api/oauth2-redirect as the Authorization callback URL.
3. Copy the Client ID and generate a Client Secret.
4. Enable GitHub under Settings → Auth providers in PocketBase.

Each active provider will automatically appear on the login page generated by PocketBase. Your frontend only needs to call pb.collection('users').authWithOAuth2({ provider: 'google' }) via the JavaScript SDK.

PocketBase stores everything in the pb_data folder: the SQLite database (pb_data/data.db), uploaded files (pb_data/storage/) and logs. A complete backup is simply archiving that folder.

Method 1 — simple cron: add this line to your crontab (crontab -e) for a daily archive at 3am:

0 3 * * * tar czf /var/backups/pocketbase-$(date +\%F).tar.gz /opt/pocketbase/pb_data && find /var/backups -name 'pocketbase-*.tar.gz' -mtime +7 -delete

This command creates a dated archive and deletes backups older than 7 days.

Method 2 — built-in PocketBase backups: from the /_/ interface, go to Settings → Backups. PocketBase can create pb_data archives directly from the admin or via the API (POST /api/backups). You can download these archives or send them to an S3-compatible storage.

Method 3 — rclone to S3: for automatic off-site copying, use rclone:

0 4 * * * rclone sync /opt/pocketbase/pb_data your-remote:pocketbase-backup/

your-remote is an rclone profile configured to Backblaze B2, AWS S3 or any compatible object storage. Always keep a copy off the server — if the disk fails, a local-only backup is useless.

Port already in use: if docker compose up fails with bind: address already in use on port 80 or 443, check with ss -tlnp | grep ':80' which service is using the port. An nginx or Apache installed on the host conflicts with Caddy. Stop it (systemctl stop nginx) or change its ports.

Permissions on pb_data: PocketBase runs as user nobody (UID 65534) in the official container. If you mount a folder created by root, the process cannot write. Fix with chown -R 65534:65534 /opt/pocketbase/pb_data.

/_/ inaccessible after startup: verify that the reverse proxy points to the Docker service name (pocketbase:8090) and not localhost:8090. In a Docker Compose network, services communicate by their name, not via localhost.

Updating PocketBase: change the image tag in docker-compose.yml (e.g. ghcr.io/muchobien/pocketbase:0.23) then docker compose pull && docker compose up -d. PocketBase performs schema migrations automatically on startup. Back up pb_data before any major update.

Let's Encrypt certificate not obtained: Caddy needs ports 80 and 443 accessible from the Internet for the HTTP-01 challenge. Check your firewall (ufw status) and your hosting provider's security group rules.

Admin CLI: PocketBase exposes a CLI for common operations without going through the web interface. From the container: docker exec -it pocketbase_pocketbase_1 /pb/pocketbase --help. You can create a super-admin from the command line, run migrations or check the database health.

Custom collections: in /_/, create your collections (equivalent to tables) by defining typed fields (text, number, bool, date, file, relation, select, JSON). API rules are expressed in PocketBase syntax (@request.auth.id != "" to restrict to logged-in users, @request.auth.id = id to limit to one's own record).

Hooks (server-side JavaScript): since PocketBase v0.17, you can extend the backend with JavaScript scripts running server-side (pb_hooks/*.pb.js). Example uses: send an email when a user is created, validate complex data before insertion, trigger a webhook to Slack. These hooks are files mounted in the container:

volumes:
  - ./pb_data:/pb_data
  - ./pb_hooks:/pb_hooks

JavaScript SDK: the official SDK (npm install pocketbase) simplifies calls from your React, Vue or mobile frontend. It handles authentication, token refresh and real-time subscriptions (pb.collection('tasks').subscribe('*', callback)).