The shortest supported way to run Pingvin Share on a VPS is Docker Compose. Put the application behind a domain and TLS reverse proxy, set TRUST_PROXY=true, and persist both ./data and ./data/images. For large files, use Docker with an external proxy such as Caddy rather than relying on Pingvin Share’s built-in proxy.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
This guide covers a production-minded deployment, including project selection after the original repository was archived, DNS and firewall preparation, Compose, HTTPS, backups, upload limits, optional integrations, updates, and recovery.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What you are deploying
Pingvin Share is a self-hosted file-sharing application. A typical VPS layout has four layers:
- Internet and DNS: a hostname such as
share.example.comresolves to the VPS. - Reverse proxy: Caddy, Nginx, Traefik, or another proxy terminates HTTPS and forwards requests to Pingvin Share.
- Pingvin Share container: the Compose service listens on port 3000 in the documented installation example.
- Persistent storage: application data and uploaded image assets live in bind-mounted directories on the host.
The configuration reference also identifies a backend port of 8080 and a SQLite URL of file:../data/pingvin-share.db?connection_limit=1. You normally do not publish the backend directly; let the application’s documented container setup and your reverse proxy handle the public request path.
#1 Best Overall
- 【Advanced Home Data & Media Hub】For advanced home users who need phone backup, file storage, and centralized data management. Centralize family photos, 4K videos, movies, computer backups, and personal files in one place while running multiple apps for home entertainment and everyday data management. Suitable for households with growing digital libraries and multiple NAS use cases.
- 【Built for Creators, Media Servers & Advanced Apps】Powered by the Intel N100 Quad-Core CPU, 8GB DDR5 RAM, 2.5GbE networking, and dual M.2 NVMe slots, DXP2800 handles large files and heavier workloads with ease. Run Docker, virtual machines, and media server applications compatible with Plex—ideal for content creators, tech enthusiasts, and advanced home users managing 4K videos, RAW photos, personal media libraries, and multiple NAS apps.
- 【Up to 80TB for Growing Digital Libraries】 Supports up to 80TB of storage using two HDD bays and two M.2 NVMe SSD slots for family photos, movies, RAW photos, 4K videos, work files, and device backups. AI photo management supports recognition of people, objects, scenes, and locations, album organization, and duplicate photo detection. HDDs and SSDs are not included.
- 【AI-powered Home Surveillance】Turn DXP2800 into a centralized home surveillance hub by connecting compatible network cameras and storing recordings locally on your NAS. AI-powered features include Face Recognition, People Detection, and Pet Detection, helping advanced home users review important events more efficiently while managing home surveillance and personal data in one place.
- 【One data Center Across Your Devices】Keep files from desktops, laptops, phones, tablets, and other devices together instead of scattered across cloud accounts and external drives. Access, back up, organize, and share data across Windows, macOS, Android, iOS, web browsers, and compatible smart TVs—ideal for creators and advanced home users working across multiple devices.
Choose the project and image before you install
The original Pingvin Share repository is archived. Its README marks the project as archived and dates that status to June 29, 2025. That matters because an old container tag can continue to run while receiving no further fixes.
Pingvin Share X presents itself as a maintained fork and documents Docker Compose installation, a beta image channel, and a standalone requirement of Node.js 22 or newer. The original standalone instructions list Node.js 16 or newer. Those Node requirements apply to running the application outside Docker; a container deployment uses the runtime packaged in the image.
| Decision point | Original Pingvin Share | Pingvin Share X |
|---|---|---|
| Maintenance status | Repository archived; archive date stated as June 29, 2025 | Fork presented as maintained |
| Documented standalone Node.js requirement | Node.js 16 or newer | Node.js 22 or newer |
| Container guidance | Compose image commonly shown as stonith404/pingvin-share |
Compose installation and a beta image channel are documented |
| Existing-data compatibility | Do not assume a drop-in migration; check the fork’s release and migration notes for the exact version you intend to run. | |
Before pinning an image, verify its owner, release tag, security advisories, and migration instructions. The command below mirrors the original documentation’s image name as an operational example; review it rather than blindly using an unpinned latest tag in a long-lived production service.
VPS prerequisites and sizing
Pingvin Share does not publish a minimum CPU, RAM, disk, or bandwidth specification in the referenced documentation. Size the VPS from your actual transfer pattern instead of treating a nominal hardware number as a guarantee.
Host checklist
- A supported Linux VPS with a current Docker Engine.
- The Docker Compose plugin, so the
docker composecommand is available. - A DNS A or AAAA record pointing the chosen hostname to the VPS address.
- Firewall access for SSH and for the HTTP/HTTPS ports used by your reverse proxy. The application’s internal port does not need to be public when the proxy is on the same host.
- Enough disk for uploaded files, generated assets, database growth, logs, and backup copies.
- Enough network capacity for simultaneous uploads and downloads. A file-sharing service can exhaust a small VPS transfer allowance faster than a low-traffic website.
Plan storage before the first upload
Retention settings, visitor limits, and share expiration can reduce the amount of data kept indefinitely, but they do not replace capacity planning. Decide where old shares go, how frequently you will back up the service, and how much free space must remain for a restore or a temporary upload. If you expect heavy traffic, evaluate storage performance and database strategy separately; no official performance benchmark is published for this deployment.
Rank #2
- Entry-level NAS Personal Storage：UGREEN NAS DH2300 is your first and best NAS made easy. It is designed for beginners who want a simple, private way to store videos, photos and personal files, which is intuitive for users moving from cloud storage or external drives and move away from scattered date across devices. This entry-level NAS 2-bay perfect for personal entertainment, photo storage, and easy data backup (doesn't support Docker or virtual machines).
- Set Your Devices Free, Expand Your Digital World: This unified storage hub supports massive capacity up to 64TB.*Storage drives not included. Stop Deleting, Start Storing. You can store 22 million 3MB images, or 2 million 30MB songs, or 43K 1.5GB movies or 67 million 1MB documents! UGREEN NAS is a better way to free up storage across all your devices such as phones, computers, tablets and also does automatic backups across devices regardless of the operating system—Window, iOS, Android or macOS.
- The Smarter Long-term Way to Store: Unlike cloud storage with recurring monthly fees, a UGREEN NAS enclosure requires only a one-time purchase for long-term use. For example, you only need to pay $459.98 for a NAS, while for cloud storage, you need to pay $719.88 per year, $2,159.64 for 3 years, $3,599.40 for 5 years. You will save $6,738.82 over 10 years with UGREEN NAS! *NAS cost based on DH2300 + 12TB HDD; cloud cost based on 12TB plan (e.g. $59.99/month).
- Blazing Speed, Minimal Power: Equipped with a high-performance processor, 1GbE port, and 4GB RAM on Board, this NAS handles multiple tasks with ease. File transfers reach up to 125MB/s—a 1GB file takes only 8 seconds. Don't let slow clouds hold you back; they often need over 100 seconds for the same task. The difference is clear.
- Let AI Better Organize Your Memories: UGREEN NAS uses AI to tag faces, locations, texts, and objects—so you can effortlessly find any photo by searching for who or what's in it in seconds. It also automatically finds and deletes similar or duplicate photo, backs up live photos and allows you to share them with your friends or family with just one tap. Everything stays effortlessly organized, powered by intelligent tagging and recognition.
Install Docker and verify the host
Install Docker Engine and the Compose plugin using your Linux distribution’s supported instructions. Then verify that the current user can run Docker without an unexpected permission failure:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →docker --version
docker compose version
docker run --rm hello-worldIf the last command fails because the Docker daemon is stopped or the user lacks permission, fix that before creating the application. Do not expose a management socket or administrative interface to the public internet while troubleshooting.
Create the application directory and download Compose
Create a dedicated directory so the bind mounts and future backups have an obvious boundary:
mkdir -p ~/pingvin-share && cd ~/pingvin-share
curl -O https://raw.githubusercontent.com/stonith404/pingvin-share/main/docker-compose.ymlThe raw download is the installation example documented for the original project. Treat it as a starting point: inspect the file, compare its image tag with the release you have reviewed, and use the maintained fork’s Compose file when that is the project you selected.
Keep the Compose file and the data directories together. Relative paths such as ./data are resolved from the directory containing the file, so running Compose from a different directory can accidentally create a second, empty deployment.
Rank #3
- Your Personal Streaming Server - Build your own Netflix-style media library and stream 4K movies, shows and photos to any device without monthly fees
- Create Your Own Cloud - Store your entire photo, video and music collection; access from anywhere with fast 282 MB/s transfer speeds
- Creator-Grade Backup Solution - Protect your irreplaceable content with automated backups to cloud services, external drives and remote NAS
- Multi-Layered Data Protection - Combine RAID redundancy, automated backups and snapshot technology to prevent data loss from any cause
- Smart Home Surveillance - Support up to 30 IP cameras with AI detection, instant alerts and secure remote monitoring
Compose file: the important lines
The documented example uses the stonith404/pingvin-share image, maps host port 3000 to container port 3000, sets TRUST_PROXY=false by default, and mounts two host directories. A minimal equivalent looks like this:
services:
pingvin-share:
image: stonith404/pingvin-share
ports:
- '3000:3000'
environment:
TRUST_PROXY: 'false'
volumes:
- ./data:/opt/app/backend/data
- ./data/images:/opt/app/frontend/public/imgWhy each mount matters
./data:/opt/app/backend/datastores the application’s database and backend data. The documented default database URL points into this data directory../data/images:/opt/app/frontend/public/imgstores uploaded image assets used by the frontend.- If either mount is missing, a container recreation can leave you with an empty database or missing image assets even though the new container starts successfully.
The exact Compose file supplied by the project may contain additional settings. Preserve those settings when you update rather than reducing a production file to the minimal example without checking what they do.
Start the container and perform a local check
- From the directory containing
docker-compose.yml, start the service in detached mode:docker compose up -d - Confirm that Compose reports the service as running:
docker compose ps - Inspect startup output if the service is not healthy:
docker compose logs --tail=200 pingvin-share - From the VPS itself, request the documented local address,
http://localhost:3000. A browser on your own computer cannot uselocalhostto reach the VPS; use the server’s address through the reverse proxy instead.
At this stage, create the administrator account using a strong, unique password. Do not publish an unauthenticated administration endpoint as a substitute for completing the first-run setup.
Attach a domain and HTTPS reverse proxy
Point your chosen DNS record at the VPS, allow the proxy’s HTTP and HTTPS ports through the firewall, and configure the proxy to forward the complete application path to the Pingvin Share container. TLS should terminate at the proxy; the proxy then connects to the application on the private host network or through the published port.
Free tools Windows power users keep installed
One-click scans. No signup required.
Set the proxy trust flag
When a reverse proxy is in front of Pingvin Share, change the environment value to:
Rank #4
- Entry-level NAS Home Storage: The UGREEN NAS DH4300 Plus is an entry-level 4-bay NAS that's ideal for home media and vast private storage you can access from anywhere and also supports Docker but not virtual machines. You can record, store, share happy moment with your families and friends, which is intuitive for users moving from cloud storage, or external drives to create your own private cloud, access files from any device.
- Smart Photo Backup & AI Album: Automatically back up photos and videos from your phone in real time and keep growing family memories organized with AI-powered photo albums. Semantic search, custom learning, and recognition of people, objects, pets, and similar photos help you quickly find the moments you want. Duplicate photo removal also helps keep your library organized—ideal for families and users with large photo collections.
- User-Friendly App & Easy Setup: Connect quickly via NFC, set up simply and share files fast on Windows, macOS, Android, iOS, web browsers, and smart TVs. You can access data remotely from any of your mixed devices. What's more, UGREEN NAS enclosure comes with beginner-friendly user manual and video instructions to ensure you can easily take full advantage of its features.
- More Cost-effective Storage Solution: Unlike cloud storage with recurring monthly fees, A UGREEN NAS enclosure requires only a one-time purchase for long-term use. For example, you only need to pay $629.99 for a NAS, while for cloud storage, you need to pay $719.88 per year, $1,439.76 for 2 years, $2,159.64 for 3 years, $7,198.80 for 10 years. You will save $6,568.81 over 10 years with UGREEN NAS! *NAS cost based on DH4300 Plus + 12TB HDD; cloud cost based on 12TB plan (e.g. $59.99/month).
- Your Data, You Control：No third-party clouds, no hidden access, UGREEN NAS provides a more secure and private data storage solution. It stores data locally on your private hard drives and does automatic backups. Thus, you can keep full control over it. The advanced encryption is TRUSTe certified in the United States and is awarded the first (and only) ETSI EN 303 645 certification mark for NAS products by TÜV SÜD Group.
TRUST_PROXY: 'true'This tells the application to trust the forwarding information supplied by the proxy. Only enable it when the proxy is actually controlling the incoming connection. If you leave the value at false behind a TLS proxy, generated links, client-address handling, or secure-request detection can behave incorrectly.
Map every path, not just the home page
If you disable the application’s internal Caddy behavior with CADDY_DISABLED=true, the configuration reference requires the external proxy to map all paths correctly. A proxy rule that forwards only / but drops API, upload, or static-asset paths will produce a page that loads while sign-in or transfers fail.
A minimal Caddy-style example is:
share.example.com {
reverse_proxy 127.0.0.1:3000
}Use the equivalent catch-all proxy rule in your chosen software, obtain a certificate for the hostname, and preserve request methods and headers. Proxy-specific body-size, timeout, and buffering settings must be chosen for the largest files you intend to accept.
Keep the application port private when possible
The documented Compose mapping is 3000:3000, which publishes the port on the host. If your proxy runs on the same VPS, restrict direct access to port 3000 with the host firewall or bind it only to the loopback interface after confirming that your proxy can still reach it. The public entry point should be the HTTPS hostname, not an alternate unauthenticated port.
Persist data and design backups
The two bind mounts define the practical persistence boundary:
Best Value
- Secure private cloud - Enjoy 100% data ownership and multi-platform access from anywhere
- Easy sharing and syncing - Safely access and share files and media from anywhere, and keep clients, colleagues and collaborators on the same page
- Automated Backup Protection - Set-and-forget backups for Macs, PCs and mobile devices to multiple destinations including cloud and external drives
- Home Security System - Record and monitor your property 24/7 with support for multiple IP cameras and remote viewing
- 2-Year Warranty - Reliable hardware backed by Synology's expert customer support team and ongoing software updates
./datacontains the backend data and SQLite database../data/imagescontains frontend image assets.
Back up both directories together. A database-only backup can restore share metadata while leaving image assets absent; an images-only backup cannot reconstruct the database that references those assets.
A simple offline backup sequence
- Record the project directory and the image tag currently deployed:
cd ~/pingvin-share docker compose images - Stop writes briefly if you need a filesystem-consistent SQLite copy:
docker compose stop - Create an archive outside the live directory, using a destination with sufficient free space:
tar -czf ~/pingvin-share-backup-$(date +%F).tar.gz data - Start the service again and verify it loads:
docker compose start
The stop-and-archive sequence reduces the chance of copying a database while it is changing. Store at least one backup away from the VPS and periodically perform a test restore on a separate directory or host. A backup that has never been restored is only an assumption.
Handle large uploads deliberately
The installation guide says that Pingvin Share uses a built-in reverse proxy by default to reduce installation steps, but also warns that this proxy is not optimized for uploading large files. The documented recommendation is the Docker installation or an external reverse proxy, with a Caddy example in the project.
For a VPS expected to handle large transfers:
- Run Pingvin Share in Docker and keep the container’s data mounts on storage sized for the upload volume.
- Terminate HTTPS at an external proxy rather than relying on the built-in large-upload path.
- Set the proxy’s maximum request body size above your intended largest file.
- Set read, write, and idle timeouts long enough for a slow client to finish without being disconnected.
- Review buffering behavior. Buffering an entire upload can consume disk or memory; streaming can change how failures appear to the client.
- Check any upstream firewall, load balancer, or CDN limits as well as the proxy setting. The smallest limit in the chain wins.
- Test with a file near your intended limit from a remote connection, then inspect both proxy and container logs.
Pingvin’s documentation does not prescribe numeric body-size or timeout values, so choose them from your users’ file sizes and network conditions rather than copying a value presented as universal.
Optional malware scanning and integrations
ClamAV
ClamAV is optional. The configuration reference documents CLAMAV_HOST and CLAMAV_PORT; the stated defaults are host 127.0.0.1 (or clamav in Docker) and port 3310. Enable it only after running a ClamAV service that the Pingvin container can reach, then confirm scan failures are visible in logs and do not silently allow files through.
Authentication and storage options
The project README lists OIDC, LDAP, local storage, and S3 among its capabilities. It also lists expiration dates, visitor limits, and password-protected shares. These are feature choices, not prerequisites for a basic VPS deployment. Add one at a time, document the environment variables or provider settings you changed, and test login, upload, download, and expiration behavior before making the service public.
Security and maintenance routine
- Use a strong administrator password and do not reuse it on the VPS or DNS account.
- Allow SSH only from the networks or keys you actually use, and disable password authentication when your operating-system policy permits.
- Keep the host operating system, Docker Engine, Compose plugin, reverse proxy, and Pingvin image updated.
- Review image tags and release notes before pulling an update, especially because the original repository is archived.
- Expose only the HTTPS service publicly; restrict port 3000 and never expose a Docker socket.
- Watch disk usage. Failed uploads, logs, and backup archives can fill a VPS even when the application itself appears healthy.
- Back up both persistence directories and keep a tested restoration procedure.
Updating without losing data
- Read the target image’s release notes and confirm whether a database migration or special upgrade order is required.
- Make a fresh backup of
data, includingdata/images. - Record the current image tag and Compose file so you can roll back.
- Pull the reviewed image and recreate the service:
docker compose pull docker compose up -d - Check container status and logs, then test administrator login, an existing share, a new upload, and a download through HTTPS.
Do not delete the bind-mounted directories as part of an update. Recreating a container is safe only when the data remains on the host and the new version can read it.
Troubleshooting by symptom
| Symptom | Likely check | Action |
|---|---|---|
| The container starts but the site is empty | Compose was run from a different directory or mounts are missing | Run docker compose config, verify the project path, and confirm both bind mounts exist. |
| Images disappeared after recreation | ./data/images was not mounted or was mounted from a new empty path |
Stop the service, correct the mount, and restore the images directory from backup if necessary. |
| The domain shows a proxy error | Proxy target, container status, firewall, or published port | Check docker compose ps, test the local port from the VPS, and inspect proxy logs. |
| Login or API requests fail while the home page loads | Only the root path is forwarded | Change the proxy rule to forward the complete application path and preserve request methods. |
| HTTPS links or client addresses are wrong | TRUST_PROXY is false behind a proxy |
Set TRUST_PROXY=true, recreate the container, and retest through the hostname. |
| Large uploads stall or return a size error | Built-in proxy or an upstream body-size, timeout, or buffering limit | Use the external proxy path, raise its limits deliberately, and check every intermediary for a lower limit. |
| Updates appear to erase accounts or shares | The container was recreated without the original host data | Stop, restore the correct ./data mount, and recover from the matching backup before attempting another upgrade. |
Production readiness checklist
- The VPS has Docker Engine and the Compose plugin.
- DNS resolves the chosen hostname to the VPS.
- SSH and the proxy’s HTTP/HTTPS ports are allowed; unnecessary public ports are blocked.
- The image owner, release tag, and maintenance status were reviewed.
- Compose mounts
./dataand./data/images. - The service starts with
docker compose up -dand responds locally on port 3000. - The reverse proxy forwards every path and provides a valid certificate.
TRUST_PROXY=trueis set when the proxy is in front.- Large-upload limits, timeouts, and buffering are configured for your real files.
- Backups include both persistence directories, are stored off-host, and have been restored in a test.
- Administrator credentials are unique and the application port is not an unprotected public entry point.
For the original project, the Compose path remains the simplest deployment model, but the archive status changes how you should operate it: pin a reviewed image, monitor security notices, and evaluate the maintained fork before committing new production data.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
