A reliable Drone deployment on a VPS has two containers: a Drone server that handles the web interface, OAuth login, repositories and build orchestration, and a Docker runner that executes pipeline steps. Put both behind a real HTTPS domain, give the server and runner the same RPC secret, and treat access to /var/run/docker.sock as a major security decision. The procedure below uses Docker Compose and the current image families drone/drone:2 and drone/drone-runner-docker:1.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What the finished setup looks like
Drone is self-hosted, but it is not a single process. The server receives webhooks from your Git provider, presents the dashboard, creates build jobs and communicates with runners over its RPC interface. A runner polls the server for work, starts each step as a container and reports logs and status back.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Component | Container image | Role | Important configuration |
|---|---|---|---|
| Drone server | drone/drone:2 |
Web UI, OAuth integration, repository metadata, scheduling and RPC endpoint | Public host name, protocol, Git-provider OAuth credentials and RPC secret |
| Docker runner | drone/drone-runner-docker:1 |
Executes pipeline steps as Docker containers | RPC host, RPC protocol, matching RPC secret and runner capacity |
| Reverse proxy | Provided by your VPS stack | Terminates HTTPS and forwards traffic to the server | Certificate, DNS and forwarding to the server’s local port |
On a single VPS, Compose places the two Drone services on one private Docker network. The runner can then use the server service name as its RPC host, while users and the Git provider reach the public domain through HTTPS. A separate runner on another machine should use a network address that it can resolve and reach; whether that connection can safely use plain HTTP depends on the network and the exact Drone configuration, so verify the current guidance in the Drone documentation before exposing an RPC endpoint remotely.
Prerequisites and sizing
VPS requirements
- Use Ubuntu 22.04 or Ubuntu 24.04 for the straightforward path documented by current community setup guides.
- Start with at least 2 GB of RAM and 2 vCPUs. Increase resources when builds compile large projects, run multiple jobs or create substantial Docker images.
- Use a real domain name with HTTPS for the server. Raw IP addresses, plain HTTP and temporary tunnels are suitable only for short-lived experiments, not a production CI endpoint.
- Reserve persistent disk space for the Drone server volume, Docker images, build caches and logs. The exact amount depends on repository size and retention.
Software and accounts
- Install Docker Engine from Docker’s own Ubuntu apt repository, including the Docker Compose plugin. Confirm both commands before continuing:
docker --version
docker compose version- Have administrator access to a supported Git provider so you can create an OAuth application and configure its callback address.
- Control DNS for the CI host name and be able to obtain an HTTPS certificate through your reverse-proxy or certificate tooling.
- Have an account name ready for the first Drone administrator. The optional
DRONE_USER_CREATEsetting can create that account on first startup; check the current syntax for your Drone release.
Prepare the VPS
Install Docker and Compose
Follow Docker’s official Ubuntu repository procedure rather than an old distribution package. Install the Engine, CLI, container runtime, Buildx plugin and Compose plugin. Then run a harmless test container and remove it:
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
sudo docker run --rm hello-world
docker compose versionIf the second command is unavailable, install the Compose plugin before creating the Drone stack. Add your deployment user to the Docker group only if you understand that group membership grants root-equivalent control of the host.
Create a private project directory
sudo mkdir -p /opt/drone
sudo chown "$USER":"$USER" /opt/drone
cd /opt/drone
umask 077Keep the Compose file and environment file on the VPS, not in a public repository. Restrict the environment file to the deployment account because it contains OAuth credentials and the RPC secret.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Generate and protect the RPC secret
The server and every runner authenticate their RPC connection with one identical random value. Generate it with OpenSSL:
openssl rand -hex 16Copy the output into /opt/drone/.env. Do not generate separate values for the server and runner, and do not paste the secret into a pipeline file.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
DRONE_SERVER_HOST=ci.example.com
DRONE_SERVER_PROTO=https
DRONE_RPC_SECRET=replace_with_the_output_from_openssl
DRONE_GITHUB_CLIENT_ID=replace_with_oauth_client_id
DRONE_GITHUB_CLIENT_SECRET=replace_with_oauth_client_secret
DRONE_ADMIN_USER=replace_with_your_admin_usernameThe provider variables differ by Git service. The example uses GitHub-style names; GitLab, Bitbucket and other integrations use their own names. Confirm the exact variable names and callback format in the current Drone server documentation before starting the container. Never commit .env to source control or include it in a support bundle.
Create the Drone Compose stack
Save the following as /opt/drone/compose.yaml. It binds the server only to loopback so a reverse proxy can be the public HTTPS entry point. The runner shares the internal Compose network and reaches the server at drone-server.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchservices:
drone-server:
image: drone/drone:2
container_name: drone-server
restart: unless-stopped
ports:
- "127.0.0.1:8080:80"
volumes:
- drone_data:/data
environment:
DRONE_SERVER_HOST: ${DRONE_SERVER_HOST}
DRONE_SERVER_PROTO: ${DRONE_SERVER_PROTO}
DRONE_RPC_SECRET: ${DRONE_RPC_SECRET}
DRONE_USER_CREATE: username:${DRONE_ADMIN_USER},admin:true
DRONE_GITHUB_CLIENT_ID: ${DRONE_GITHUB_CLIENT_ID}
DRONE_GITHUB_CLIENT_SECRET: ${DRONE_GITHUB_CLIENT_SECRET}
drone-runner:
image: drone/drone-runner-docker:1
container_name: drone-runner
restart: unless-stopped
depends_on:
- drone-server
volumes:
- /var/run/docker.sock:/var/run/docker.sock
environment:
DRONE_RPC_HOST: drone-server
DRONE_RPC_PROTO: http
DRONE_RPC_SECRET: ${DRONE_RPC_SECRET}
DRONE_RUNNER_CAPACITY: 2
volumes:
drone_data:The server image listens on port 80 inside its container. The runner uses HTTP on the private Compose network in this example; external users still use HTTPS at the public host. If you terminate TLS inside the Drone container or place the runner on another host, change DRONE_RPC_PROTO and DRONE_RPC_HOST to match the reachable endpoint and validate the arrangement against the current documentation.
Why the Docker socket matters
The runner needs the host’s Docker socket to launch build containers. A process that can control that socket can generally control the Docker daemon and, in practice, the VPS itself. Do not put this runner on a host that also contains unrelated tenants or sensitive services unless you have accepted that trust boundary. A dedicated CI VPS, strict SSH access, regular host patching and isolated networks reduce the blast radius but do not remove the risk.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Register the Git OAuth application
- In your Git provider’s developer settings, create an OAuth application for the Drone instance.
- Set the application’s homepage or service URL to the same HTTPS host stored in
DRONE_SERVER_HOST. - Use the callback path required by that provider and your Drone version. Do not guess it from a different integration; verify the current provider-specific Drone instructions.
- Copy the generated client ID and secret into
.env, using the variable names for that provider. - Ensure the VPS clock is correct and that the DNS name resolves to the reverse proxy before testing login. OAuth failures caused by a wrong host, protocol or callback address are commonly indistinguishable from bad credentials in the browser.
Start the services safely
- Render the Compose configuration and check that interpolation worked without printing secrets into a shared terminal transcript:
cd /opt/drone
docker compose config- Start the server and runner in detached mode:
docker compose up -d- Confirm both containers are running and inspect their first logs:
docker compose ps
docker compose logs --tail=100 drone-server
docker compose logs --tail=100 drone-runner- Configure the reverse proxy to forward the HTTPS host to
127.0.0.1:8080, obtain a valid certificate and preserve the original host and protocol headers. Browse to the HTTPS host and complete the Git-provider login.
If the page is unreachable, test locally first with curl -I http://127.0.0.1:8080. A local response proves the server is listening; it does not prove that DNS, the proxy or the certificate is correct.
Complete first-time administration
Verify the administrator
After OAuth login, check that the account is an administrator. If the account is not promoted, stop the stack, correct DRONE_USER_CREATE according to the current release syntax, and start it again. Treat that variable as bootstrap configuration rather than an ongoing authorization mechanism.
Recommended Free Tools
Enable a repository
- Open the repository list in the Drone dashboard and select the project.
- Activate the repository so Drone can install its webhook and read pipeline configuration.
- Check the repository’s trusted or privileged setting before using Docker-in-Docker, host networking or other capabilities. Only enable privileges for code you control.
- Push a commit or use the provider’s webhook delivery test. The repository should appear in the dashboard with a pending or running build.
Write a first pipeline
Drone reads a .drone.yml file from the repository. This minimal Docker pipeline is useful for proving checkout, step execution and log reporting before adding a game engine, compiler or deployment tool:
kind: pipeline
type: docker
name: default
steps:
- name: verify
image: alpine:3.20
commands:
- echo "Drone runner is executing this build"
- test -f README.md
trigger:
event:
- push
- pull_requestCommit the file and push it. The runner should create an Alpine step container, stream both command output and exit status, then mark the build successful if the file exists. Replace the verification commands with your project’s actual lint, unit-test and packaging commands only after this basic path works.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Secrets and build inputs
- Store deployment keys, signing credentials and API tokens as encrypted repository or organization secrets, not in YAML or Git history.
- Use separate credentials for pull requests from untrusted forks. A pull request should not automatically receive production secrets.
- Pin important build images by a maintained tag or digest and update them deliberately. Unpinned images can change between builds.
- Keep build outputs in artifacts or an external package store rather than inside the runner container, which is disposable.
Check that the runner is connected
A healthy runner usually appears in the Drone dashboard and emits a registration or polling message in its logs. If it stays offline, work through these checks in order:
Free tools Windows power users keep installed
One-click scans. No signup required.
| Symptom | Likely cause | Action |
|---|---|---|
| Runner repeatedly reports authentication or RPC errors | DRONE_RPC_SECRET differs between services, contains an accidental quote or was changed in only one container |
Compare the value in .env, recreate both services with docker compose up -d --force-recreate, and inspect logs without publishing the secret. |
| Runner cannot resolve the server | Wrong host name or an attempt to use the public DNS name from an isolated network | For one Compose stack, use drone-server. For a remote runner, use a routable name or address and open only the required path. |
| Protocol or redirect errors | DRONE_RPC_PROTO does not match the endpoint, or external HTTPS settings were copied to the internal HTTP network |
Use http for the private service-to-service example, or https when the runner genuinely connects through TLS. Confirm the topology in current Drone documentation. |
| Build remains pending | No online runner, runner capacity exhausted or repository disabled | Check runner logs, dashboard status, DRONE_RUNNER_CAPACITY and repository activation. |
| Build fails before commands run | Docker socket unavailable, image pull failure or insufficient disk/RAM | Verify the socket mount, test an image pull, inspect df -h and memory pressure, then retry. |
| OAuth login loops or returns an invalid callback error | Host, protocol or callback path differs between the provider, proxy and Drone environment | Make every URL use the same canonical HTTPS host and recheck provider-specific OAuth settings. |
Capacity, performance and multiple runners
DRONE_RUNNER_CAPACITY limits how many builds one Docker runner executes concurrently. A value of 2 is conservative for a 2-vCPU VPS; raising it can improve throughput but increases CPU, memory, disk and network contention. Measure queue time and failed builds before increasing it.
When one VPS is no longer sufficient, add runners rather than giving the server unrestricted resources. Each runner needs the same RPC secret, a reachable RPC host and its own Docker socket. Use labels or repository restrictions when different projects require different operating systems, accelerators or trust levels. A remote runner should normally connect through a protected HTTPS endpoint; the exact requirement depends on the network topology and should be checked against current Drone guidance.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Backups and upgrades
Protect the server data
The named drone_data volume contains server state. Back it up with the containers stopped or with a storage method that gives you a consistent snapshot. Also preserve compose.yaml and a securely stored copy of the environment values; without the OAuth secret and RPC secret, a volume restore may not be enough to recreate the service.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Keep image versions current
Use the maintained major-image families drone/drone:2 and drone/drone-runner-docker:1, then check Drone’s official documentation for current release guidance before upgrading. Some older tutorials still use 1.x server images such as drone/drone:1.9.1; do not copy those tags into a new installation. Community templates can also pin obsolete versions and should be treated only as starting points.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches- Read the release notes and verify that your provider variables and database expectations remain valid.
- Back up the server volume and copy the Compose and environment files to protected storage.
- Pull the selected images with
docker compose pull. - Recreate the services with
docker compose up -d. - Watch server and runner logs, run a harmless repository build and confirm OAuth, webhooks and artifacts before declaring the upgrade complete.
Do not assume that the latest tag, a community guide or a template is current as of October 2026. Check the release and installation pages immediately before production changes.
Security checklist for a production VPS
- Use HTTPS and a canonical DNS name; do not expose the server’s internal port directly to the internet.
- Limit firewall access to SSH, HTTPS and any narrowly required administration path.
- Use a dedicated, patched VPS for runners because Docker socket access is effectively host-level access.
- Protect the RPC secret and OAuth secret with filesystem permissions and a password manager; rotate them through a planned maintenance window.
- Disable or restrict privileged pipelines, host networking and arbitrary volume mounts for repositories you do not fully trust.
- Set a runner capacity appropriate to available CPU and memory, and monitor disk growth from images, logs and workspaces.
- Back up the Drone data volume and test restoring it on an isolated machine.
- Review image tags and environment variables against docs.drone.io before every major upgrade, especially because the official server installation variable reference was not always mirrored by community guides.
When self-hosting Drone is the wrong fit
A VPS gives control over data location, runner images and network access, but you operate the operating system, Docker daemon, TLS endpoint, backups, upgrades and incident response. A managed CI service removes much of that maintenance at the cost of less infrastructure control and a different security model. The decisive questions are whether your team can patch and monitor a public server, whether Docker socket access can be isolated, and whether your builds justify a permanently running machine.
Final deployment test
- Resolve the HTTPS domain to the VPS and verify the certificate from an external network.
- Log in through the Git provider and confirm the intended account is an administrator.
- Activate a test repository and confirm its webhook arrives.
- Run the minimal pipeline, then a representative test build.
- Stop the runner briefly and confirm a build becomes pending; start it again and confirm the queued build runs.
- Review logs for leaked secrets, check disk and memory use, and record the exact image tags and Compose file used.
At that point, the server is handling orchestration, the runner is executing isolated Docker steps, and the shared RPC secret is proving that the two halves belong to the same installation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →
