To self-host Bitwarden, use a Linux machine running Docker Engine 26 or newer, point a domain at its public IP, open ports 80 and 443, obtain a Bitwarden installation ID and key, and configure a signed TLS certificate. Choose Standard for the full multi-container deployment on an x64 server, or Lite for a smaller single-container installation that also supports ARM64 devices such as a Raspberry Pi.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The two deployments have different hardware and architecture requirements. Decide between them before you create the host, because the official Standard implementation does not run on ARM.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Standard versus Lite: choose before installing
Bitwarden publishes two Docker deployment models. Standard spreads the service across multiple containers and is intended for larger installations. Lite combines the service into one container, reducing resource use and making it practical for personal or small-team hosting.
| Deployment | Minimum memory | Storage | Processor and architecture | Container layout | Best fit |
|---|---|---|---|---|---|
| Standard | 2 GB RAM; 4 GB recommended | 12 GB minimum; 25 GB recommended | 1.4 GHz x64 processor; x64 only | Multi-container | Larger installations and teams that need the full Standard deployment |
| Lite | About 200 MB RAM | About 1 GB | x64 or ARM64 | Single-container | Personal or small-team use, including Raspberry Pi hosts |
Both options require Docker Engine 26 or newer. Current Docker Engine releases include Compose as a plugin, so install the current Docker package rather than relying on an old standalone Compose binary.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
When Standard is the safer choice
Use Standard when the host is an x64 server with at least 2 GB of memory and you expect a larger user base or a more substantial deployment. Treat 4 GB of RAM and 25 GB of storage as the practical target rather than the floor. Standard’s official implementation does not support ARM, regardless of how much memory an ARM board has.
When Lite is the better fit
Lite is the resource-conscious option. Its approximately 200 MB memory and 1 GB storage requirements suit a small virtual machine, home server, or ARM64 board. It also avoids the multi-container footprint of Standard. For a Raspberry Pi, verify that the operating system and Docker installation are 64-bit ARM64; a 32-bit ARM system does not meet the stated architecture requirement.
Requirements checklist
Have every item below ready before running the Bitwarden installer:
- A Linux host with Docker Engine 26 or newer.
- A non-root account for the installation. Bitwarden’s Standard requirements specifically call for running the installer as a non-root user.
- A domain name whose DNS record points to the host’s public IP address.
- Inbound TCP port 80 for HTTP traffic and certificate validation.
- Inbound TCP port 443 for HTTPS traffic.
- A signed TLS certificate. Let’s Encrypt is the usual route and requires a domain that resolves to the host.
- A Bitwarden installation ID and installation key requested through Bitwarden’s self-host portal using an email address.
- For Standard, at least 2 GB RAM, 12 GB storage, and a 1.4 GHz x64 processor. For a more comfortable installation, plan for 4 GB RAM and 25 GB storage.
- For Lite, approximately 200 MB RAM, 1 GB storage, and either x64 or ARM64 hardware.
Prepare and verify the Linux host
Use a supported Linux distribution and keep the host dedicated enough that Docker can maintain the required memory and storage. Do not perform the Bitwarden installation from a root shell. Create or select an ordinary administrative account, then give that account the Docker permissions required by your distribution.
Confirm the CPU architecture
Run this before choosing the deployment:
uname -mAn x86-64 result is suitable for either deployment. An ARM64 result is suitable for Lite, but not for the official Standard implementation. If the command reports a 32-bit ARM architecture, do not proceed with the ARM64 Lite plan.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Check Docker and Compose versions
Verify the server-side Docker version and Compose plugin:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
docker versiondocker compose versionThe Docker Engine version must be 26 or newer. A current Compose plugin should be available through the Docker Engine package. If the server reports an older engine, upgrade it before installing Bitwarden; guides that cite Docker 20.10 or 24.x do not meet the current 26+ requirement.
Check memory and disk space
These commands provide a quick capacity check:
free -hdf -h /For Standard, the official floor is 2 GB RAM and 12 GB storage. Leave headroom for the operating system, Docker images, logs, and database growth; 4 GB RAM and 25 GB storage are the recommended Standard figures. Lite’s approximately 200 MB RAM and 1 GB storage figures are minimum-scale requirements, not a guarantee that every host workload will fit comfortably.
Set up DNS, firewall access, and TLS
Point the domain first
Create the DNS record for the hostname you will use with Bitwarden and point it to the host’s public IP address. Wait until that name resolves correctly from outside your network before starting installation. If the name still resolves to an old address, certificate issuance and browser access will fail even when Docker is healthy.
Allow ports 80 and 443
Port 80 is used for HTTP access and certificate validation; port 443 is the HTTPS endpoint users should use. Permit both ports through the host firewall, cloud security group, router, and any upstream NAT. Forwarding only 443 is insufficient when the selected certificate workflow needs HTTP validation on port 80.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Use a signed certificate
Bitwarden requires a signed TLS certificate. Let’s Encrypt is the usual choice for a public domain, but its validation process still depends on correct DNS and reachable port 80. If another reverse proxy or web server already occupies either port, stop, reconfigure, or relocate that service before certificate validation. Do not expose the vault over plain HTTP as a substitute for TLS.
Request the Bitwarden installation credentials
Before self-hosting, request an installation ID and installation key from Bitwarden’s self-host portal. The request uses an email address. Keep both values available when the installer asks for them; they identify the self-hosted installation and are separate from the credentials you later use to sign in to the vault.
Do not paste the ID or key into shell history, a public issue, or an unencrypted notes file. If you are handing the installation to another administrator, transfer the values through a protected channel and remove temporary copies after setup.
Install the Standard deployment
Standard is the multi-container, x64-only option. The exact prompts and package names can change as Bitwarden updates its installer, so use the current Standard installer instructions supplied in Bitwarden’s self-host documentation rather than an old third-party script.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match- Log in to the Linux host with the non-root account you prepared.
- Confirm that the host is x64, Docker Engine is version 26 or newer, and the Docker Compose plugin responds.
- Run the current Bitwarden Standard installer from the account that will own the deployment. Do not launch it as root.
- When prompted, enter the installation ID and installation key obtained from Bitwarden.
- Provide the fully qualified domain name whose DNS record points to this host.
- Select the TLS option and allow the installer to obtain or configure a signed certificate. Ensure port 80 is reachable during validation and port 443 is available for the finished service.
- Review the generated configuration before starting the containers. Check the hostname, certificate mode, storage location, and any database choices.
- Start the deployment using the start action documented by the current installer, then inspect the container status and logs for failed health checks, certificate errors, or database startup failures.
- Open the domain over HTTPS in a browser. The address should use
https://, present a valid certificate for the hostname, and load the Bitwarden web interface.
Understand Standard’s database
Standard uses an MSSQL Express image by default. That relational database has a 10 GB maximum size. An external database is possible when the default database is not appropriate for your deployment, but the external service must be planned and administered separately. The 10 GB limit applies to the default MSSQL Express arrangement, not to every possible external-database design.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Install Bitwarden Lite
Lite uses one container and supports both x64 and ARM64. It is the practical route for a Raspberry Pi or another low-resource ARM64 host.
- Prepare a 64-bit Linux system with Docker Engine 26 or newer.
- Use a non-root account for the installation and verify the account can run Docker.
- Confirm that the domain resolves to the host and that ports 80 and 443 reach it from the internet.
- Run the current Bitwarden Lite installer from Bitwarden’s self-host documentation.
- Enter the installation ID and key when requested, then provide the domain name.
- Configure the signed TLS certificate and complete validation through port 80 before serving HTTPS on port 443.
- Start the single container and check its status and logs.
- Browse to the HTTPS hostname and complete the initial account setup.
Lite’s lower resource requirement does not remove the networking or TLS prerequisites. A Raspberry Pi with insufficient upstream bandwidth, blocked inbound ports, or an unresolvable domain will fail for the same reasons as a larger server.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Verify the finished deployment
Perform these checks from both the host and an external device:
- Architecture: the selected deployment matches the result of
uname -m. - Engine: Docker Engine reports version 26 or newer.
- Containers: Standard shows its multi-container services; Lite shows its single container running.
- DNS: the configured hostname resolves to the host’s public IP, not a private LAN address.
- Ports: external connections can reach 80 and 443.
- TLS: the browser trusts the certificate, the certificate name matches the hostname, and the site redirects or otherwise keeps users on HTTPS.
- Persistence: restarting the Docker service does not erase the installation’s configuration or vault data.
- Login: the web interface loads without a certificate warning and accepts a newly created account.
Troubleshoot the common failure branches
The installer rejects the host architecture
If the machine is ARM64 and you selected Standard, switch to Lite or move Standard to an x64 host. Standard’s official implementation does not support ARM, so adding memory or changing Compose settings will not solve an architecture mismatch.
Docker is too old
Upgrade Docker Engine to 26 or newer. Do not rely on older tutorials that specify 20.10.x or 24.x; those figures conflict with the current requirement.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Certificate validation fails
Check the DNS record from an external network, confirm that port 80 is forwarded to the correct host, and make sure another web server is not answering the validation request. Also verify that the hostname entered in the installer is exactly the name covered by the certificate.
Recommended Free Tools
The site works locally but not from the internet
Inspect every network boundary: the Linux firewall, cloud security group, router port-forwarding rule, and any carrier-grade NAT limitation. Local success proves only that the container is reachable on the LAN; it does not prove that ports 80 and 443 are publicly accessible.
Standard runs out of resources
Compare current usage with the 2 GB RAM and 12 GB storage minimums. A host close to the floor can become unstable as Docker images, logs, and the database grow. Move toward the recommended 4 GB RAM and 25 GB storage, or choose Lite when the installation is genuinely personal or small-team sized and the architecture allows it.
The default database approaches its limit
Standard’s default MSSQL Express database cannot exceed 10 GB. If your deployment is approaching that ceiling, plan a supported external-database configuration rather than assuming additional disk space removes the relational database limit.
Operational decisions after installation
Keep the domain and certificate dependable
Self-hosting makes DNS, certificate renewal, firewall rules, and host availability your responsibility. Record which hostname was entered during installation and monitor certificate expiry so an otherwise healthy container does not become inaccessible when a certificate lapses.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesPlan capacity around the deployment, not just the minimum
Minimum figures describe whether an installation can start, not how much headroom a busy host has. Standard’s 4 GB RAM and 25 GB storage recommendations provide a more realistic planning point. Lite can run in about 200 MB RAM and 1 GB storage, but leave additional capacity for the operating system and Docker’s own files.
Document the architecture choice
Write down whether the host is running Standard or Lite, its CPU architecture, the domain name, and where the installation credentials are stored securely. This prevents a future administrator from attempting to restore a Standard configuration onto an ARM64 host or assuming that the two deployment layouts use the same container set.
Which option should you use?
- Choose Lite for one person or a small team, especially on ARM64 hardware or a Raspberry Pi, when approximately 200 MB RAM and 1 GB storage are practical.
- Choose Standard for a larger installation on x64 hardware, with at least 2 GB RAM and 12 GB storage available and preferably 4 GB RAM and 25 GB storage.
- Choose neither until DNS, ports 80 and 443, TLS, Docker Engine 26+, and the installation ID and key are ready.
Once those prerequisites are satisfied, the deployment is a conventional Docker-hosting exercise: install the model that matches the hardware, let Bitwarden configure its containers and certificate, verify HTTPS externally, and keep the host’s resources and database limits under observation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
