VPS Hosting and Operations

A rented server is cheap. Operating one badly is not.

7guides Feed

A VPS is a rented Linux box with a public IP address. That is the whole product — everything else is work you do, and the interesting part of that work is the second week rather than the first.

Reach for one when you want predictable cost, no vendor-specific runtime, and the ability to run anything that runs on Linux. Databases, background workers, long-lived connections and self-hosted tools all fit here and often fit poorly elsewhere.

Reach for a managed platform instead when nobody on the team wants to be responsible for kernel updates at 2 a.m., or when the workload genuinely needs to scale horizontally without warning.

The failures are consistent across every provider. Firewalls that look correct but do not cover published container ports, because Docker manipulates iptables directly. Disks that fill with unrotated container logs. Backups that have never been restored. And a single administrator SSH key with no second path in, so one misconfigured sshd_config means rebuilding the machine.

Day-two operations is the part that separates a server that survives from one that is quietly rebuilt every few months. Unattended security upgrades, monitored disk usage, log rotation, tested restores, and a firewall you have verified by scanning from somewhere else — none of it is difficult, and all of it is skipped more often than not.

The articles here assume Ubuntu LTS and Docker, state the exact versions they were run against, and verify the result from outside the host rather than from inside it.

Start here

How to Secure a VPS That Runs Docker Containers

SSH hardening, a default-deny firewall, and the fix for the problem that catches almost everyone — Docker publishing container ports straight past UFW into the public internet.

Intermediate · 4 min read

Beginner to advanced

A reading order that builds VPS knowledge in the sequence it is actually needed.

  1. Start How to Secure a VPS That Runs Docker Containers 4 min
  2. Build How to Deploy n8n on an Ubuntu VPS with Docker 5 min
  3. Operate How to Run Cloudflare Tunnel in Front of Traefik 4 min
  • intermediate

    How to Secure a VPS That Runs Docker Containers

    SSH hardening, a default-deny firewall, and the fix for the problem that catches almost everyone — Docker publishing container ports straight past UFW into the public internet.

    4 min
  • intermediate

    How to Deploy n8n on an Ubuntu VPS with Docker

    A production n8n install on Ubuntu 24.04 using Docker Compose, PostgreSQL and Caddy for automatic TLS — with the encryption key, webhook URL and backup steps most quickstarts leave out.

    5 min

Common problems

Failure modes that come up repeatedly with VPS, and where each one is solved.

UFW is enabled but container ports are still reachable
Docker writes its own iptables rules, evaluated before UFW's. Bind published ports to loopback and add a DROP rule to the DOCKER-USER chain.
Locked out of SSH after a hardening change
Keep a second session open while editing sshd config, and always validate with `sshd -t` before restarting the service.
The disk fills up and everything stops
Unrotated container logs are the usual cause on a small host. Set json-file log limits at the daemon level so every container inherits them.
No usable backup when a volume is lost
Dump databases with their own tools, snapshot file volumes separately, and restore one into a scratch container before you rely on either.

Latest VPS guides

Browse the archive
  • intermediate

    How to Secure a VPS That Runs Docker Containers

    SSH hardening, a default-deny firewall, and the fix for the problem that catches almost everyone — Docker publishing container ports straight past UFW into the public internet.

    4 min
  • advanced

    How to Run PostgreSQL Securely on a VPS

    Keep the listener off the public internet, get pg_hba.conf right, require TLS for remote connections, and give the application a role that cannot drop your tables — on PostgreSQL 17 and Ubuntu 24.04.

    4 min
  • intermediate

    How to Back Up Docker Volumes Automatically

    A nightly backup for a self-hosted Docker host: database dumps taken with the right tools, file volumes snapshotted with restic, a systemd timer to run it, and a restore test that proves it works.

    4 min AI-assisted
  • intermediate

    Dokploy vs Coolify: Choosing a Self-Hosting Platform

    Both put a Heroku-style deploy UI on your own VPS, but on different container primitives. What that means for zero-downtime deploys, multi-server growth and the day the control plane breaks.

    6 min AI-assisted
  • beginner

    How to Point a Cloudflare Domain at Your VPS

    Create the A record, pick the right proxy status, set the SSL mode to Full (strict) and lock the origin so only Cloudflare can reach it — plus what errors 521, 522, 525 and 526 actually mean.

    4 min

Recently updated

  • intermediate

    Dokploy vs Coolify: Choosing a Self-Hosting Platform

    Both put a Heroku-style deploy UI on your own VPS, but on different container primitives. What that means for zero-downtime deploys, multi-server growth and the day the control plane breaks.

    6 min AI-assisted
  • intermediate

    How to Secure a VPS That Runs Docker Containers

    SSH hardening, a default-deny firewall, and the fix for the problem that catches almost everyone — Docker publishing container ports straight past UFW into the public internet.

    4 min
  • intermediate

    How to Back Up Docker Volumes Automatically

    A nightly backup for a self-hosted Docker host: database dumps taken with the right tools, file volumes snapshotted with restic, a systemd timer to run it, and a restore test that proves it works.

    4 min AI-assisted

Frequently asked questions

How much RAM does a small self-hosted stack need?

2 GB is the practical floor for an application plus a database, and 4 GB is comfortable once you add a reverse proxy and leave room for a container build. Below 2 GB you will spend your time debugging the OOM killer.

Is a VPS suitable for production?

For a single-team application, yes, provided someone owns patching, backups and the pager. The technology is not the constraint; the operational commitment is.

What should be done on day one, before anything is deployed?

A non-root user with an SSH key, password authentication disabled, a default-deny firewall, unattended security upgrades, and a check that published container ports are not bypassing the firewall.

Sources

  1. Ubuntu Server documentation Canonical Primary source
  2. sshd_config manual page OpenBSD Primary source
  3. Docker packet filtering and firewalls Docker Primary source