What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
You can run a code quality server on one Linux VPS with Docker, but a production deployment needs more than starting a container. Choose the edition first, size the host for Elasticsearch and your analysis workload, set the required kernel limits, persist the application volumes, move off the embedded H2 database, and put the web interface behind TLS and access controls. The sequence below gives you a practical single-VPS deployment and the operating practices needed to keep it recoverable.
Choose the edition before provisioning the VPS
Your edition determines language coverage, security features, licensing, and whether a single VPS is an appropriate architecture. Community Build is the sensible baseline for a personal project or small team. It is a free, self-managed offering released monthly and states core bug, code-smell, and basic security analysis for 21 programming languages and frameworks.
Free tools Windows power users keep installed
One-click scans. No signup required.
Commercial server editions add broader analysis and enterprise capabilities. Licenses are purchased per installation, not per user, and are priced per instance per year according to the maximum lines of code (LOC) the instance may analyze. The product family supports more than 30 languages and frameworks overall. Developer includes common stacks such as Java, Python, C#, JavaScript, TypeScript, Docker, Kubernetes and Helm, Terraform, and YAML. Enterprise and Data Center add languages and ecosystems including Apex, COBOL, Gosu, JCL, MuleSoft DataWeave, PL/I, RPG, and VB6.
| Edition | Typical use | Coverage and capabilities | Architecture | Licensing and operations |
|---|---|---|---|---|
| Community Build | Personal projects and small teams | Core bug, code-smell, and basic security analysis across 21 stated languages and frameworks | Single node | Free self-managed release; monthly updates |
| Developer | Teams needing broader language and DevOps coverage | Includes Java, Python, C#, JavaScript, TypeScript, Docker, Kubernetes/Helm, Terraform, YAML, and other supported technologies | Single node | Commercial, licensed per instance and maximum LOC |
| Enterprise | Organizations with expanded language, security, and integration requirements | Adds enterprise language coverage such as Apex, COBOL, Gosu, JCL, MuleSoft DataWeave, PL/I, RPG, and VB6 | Single node or larger deployment, depending on requirements | Commercial, licensed per instance and maximum LOC |
| Data Center | High availability and clustered resiliency | Enterprise capabilities with a cluster-oriented deployment model | Separate application and search services; clustered | Commercial; substantially more complex than one VPS |
Data Center is intended to deploy the server in a resilient cluster. Its documented pattern uses separate datacenter-search and datacenter-app containers, so it is generally mismatched to a low-cost, single-VPS installation. Confirm the edition, LOC ceiling, support requirements, and licensing terms before you buy infrastructure; changing editions later can affect sizing and migration work.
What the VPS must provide
The server embeds Elasticsearch for indexing and search. Consequently, the Docker host must satisfy Elasticsearch production-mode and file-descriptor requirements before the container starts reliably. On a Linux VPS, apply the documented baseline settings as root:
sysctl -w vm.max_map_count=524288
sysctl -w fs.file-max=131072
ulimit -n 131072
ulimit -u 8192The first two values are kernel settings; the latter two are process limits. Applying them in a shell is not enough for a reboot-proof server. Persist the kernel values in your system’s sysctl configuration and configure matching nofile and nproc limits for the account or service that launches Docker. Reboot or start a fresh session, then verify the effective values before deploying.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →- Use a current 64-bit Linux distribution with Docker Engine and the Compose plugin installed from trusted packages.
- Reserve enough memory for Elasticsearch, the web process, and concurrent analyses; the four values above are prerequisites, not a promise that any particular VPS size will handle your workload.
- Provide fast, durable storage. Indexes, project data, logs, and extensions grow with project count and analysis history.
- Allow outbound access for image retrieval and CI integrations, while limiting inbound access to administration and the reverse proxy.
- Keep substantial free disk space so an analysis or upgrade cannot fill the filesystem and stop the database or search service.
Workload sizing depends on repository count, source volume, branch and pull-request analysis, concurrent jobs, and edition. Start with a modest VPS for a small team, measure heap pressure, queue time, search health, and disk growth, then resize vertically before adding complexity.
Install Docker and create isolated storage
The shortest supported path for one VPS is the official Docker image. Create three separate named volumes. Do not point two instances at the same volume: the image warns that a volume set must not be shared by multiple instances.
docker volume create app_data
docker volume create app_logs
docker volume create app_extensionsThese map to:
/opt/app/datafor application data and search indexes/opt/app/logsfor logs needed during troubleshooting/opt/app/extensionsfor plugins and extensions
Beginning with Server 2026.1, processes also need read/write access to /tmp/ for Java Attach API socket files used while Elasticsearch 8.x initializes. Do not mount a read-only temporary directory that prevents those sockets from being created.
Start Community Build with a pinned image tag
Do not use latest for a production service. Select a current or long-term-support tag that you have tested, record it in configuration, and change it only after reading the release and upgrade notes. The minimal documented command is:
docker run -d
--name code-quality-custom
--restart unless-stopped
--stop-timeout 3600
-p 9000:9000
-v app_data:/opt/app/data
-v app_logs:/opt/app/logs
-v app_extensions:/opt/app/extensions
code-quality:communityPort 9000 is the container’s documented listening port. The mapping above exposes it on the VPS at http://host-ip:9000 for initial setup. Replace code-quality:community with the exact tested commercial tag when your license requires Developer or Enterprise.
The one-hour stop timeout matters during shutdowns and upgrades. Analyses may still be running; Docker’s default ten-second wait can terminate the process before it flushes work. A long timeout gives the application time to stop cleanly.
Watch first startup and confirm the service is ready:
docker logs -f code-quality-customWhen the web process reports readiness, open port 9000 from an administration network and complete the initial account setup. Do not leave that port publicly reachable while the instance is still using default credentials or HTTP.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallUse an external database for production
The image uses an embedded H2 database by default, and that database is not suited for production. For a real service, provision a supported external relational database, preferably on a separate recovery path from the VPS. PostgreSQL is a common choice, whether managed or operated on another host.
Create a database and a least-privilege account dedicated to this installation. Require encrypted connections when the database is outside the private host network, restrict its firewall to the VPS address, and store the username, password, and connection string in a secrets mechanism rather than committing them to source control.
With Docker, pass the database connection as environment variables. The exact JDBC URL, driver support, and database versions are release-sensitive, so verify them against the image documentation for the tag you selected. A Compose-style pattern looks like this:
services:
app:
image: code-quality:community
container_name: code-quality-custom
restart: unless-stopped
stop_grace_period: 1h
ports:
- "9000:9000"
environment:
APP_JDBC_URL: jdbc:postgresql://db.example.internal:5432/codequality
APP_JDBC_USERNAME: codequality_app
APP_JDBC_PASSWORD: ${APP_JDBC_PASSWORD}
volumes:
- app_data:/opt/app/data
- app_logs:/opt/app/logs
- app_extensions:/opt/app/extensions
volumes:
app_data:
app_logs:
app_extensions:Do not let two independent instances connect to one schema. Only a single instance or cluster may use a database schema at a time; concurrent use can corrupt data. If you are testing a second instance, create a separate database and separate volumes.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Switching from H2 to an external database is a migration, not merely an environment-variable change. Plan how existing projects, users, settings, and history will be transferred, take a backup first, and test the migration on a disposable copy before changing the live container.
Put the web interface behind TLS and strict network controls
Do not expose raw port 9000 as your public application endpoint. Terminate HTTPS at a maintained reverse proxy, forward only the private Docker or loopback address to the application, and expose 443 through the VPS firewall. Keep 9000 closed to the internet; allow it only from the proxy or an administration subnet.
- Use a valid certificate and redirect HTTP to HTTPS.
- Change the initial administrator password immediately and enforce strong credentials for every account.
- Use the smallest possible set of administrator users and review them regularly.
- Permit scanner traffic only from your CI runners or trusted networks.
- Disable direct public access to the database and restrict SSH by key, source address, and a separate administration policy.
- Keep the operating system, Docker Engine, reverse proxy, image tag, and plugins patched on a planned schedule.
Authentication at the proxy does not replace the application’s own authorization. Configure project permissions inside the application and issue CI tokens with narrow scope and short rotation intervals.
Connect CI scanners without exposing secrets
Install the scanner appropriate to each build system and configure its server URL to the HTTPS address of your VPS. Store the token in the CI platform’s encrypted secret store, inject it only into the analysis job, and avoid printing it in command output. Prefer short-lived or narrowly scoped tokens; revoke them when a runner, repository, or employee no longer needs access.
Run analysis after compilation or dependency installation when the scanner requires compiled artifacts, and make the pipeline wait for the quality-gate result if failing the gate is part of your release policy. Start with one repository, verify that the project appears with the expected branch and language detection, then roll the configuration out through a shared CI template.
Monitor queue time as concurrency increases. A growing queue, high Java heap use, slow indexing, or repeated Elasticsearch health warnings indicates that the VPS needs more memory, CPU, faster storage, fewer simultaneous jobs, or a larger architecture.
Backups, upgrades, and recovery
A VPS snapshot alone is not a complete backup. Protect the external database and the application’s persistent volumes through separate, restorable paths.
Recommended Free Tools
- Schedule consistent database backups and encrypt them in transit and at rest.
- Back up the data, logs, and extensions volumes, documenting the image tag and configuration used to restore them.
- Keep at least one backup off the VPS and test restoration on an isolated host.
- Record the database credentials, proxy configuration, firewall rules, and token-rotation procedure in a protected runbook.
- Monitor backup completion and alert on failures, unusual size changes, and shrinking free space.
Before changing an image tag, read the release and upgrade notes, confirm edition and license compatibility, and back up both the database and volumes. Rehearse the upgrade with a copy of production data. Stop the old container gracefully, allowing the one-hour timeout for active analyses, start the pinned replacement, and inspect logs before reopening traffic.
Keep the previous image tag available for rollback, but do not blindly downgrade a database after a failed upgrade. Follow the release’s documented rollback path; if the schema changed, restoring the pre-upgrade database and volume backups is safer than repeatedly starting different binaries against the same live data.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Production-readiness checklist
- Edition and maximum LOC requirement confirmed before provisioning.
- Linux kernel and process limits applied and persisted:
vm.max_map_count=524288,fs.file-max=131072,ulimit -n 131072, andulimit -u 8192. - A tested, pinned image tag is recorded;
latestis not used. - Separate persistent volumes exist for data, logs, and extensions.
- Port 9000 is firewalled from the public internet and reached through a TLS reverse proxy.
- H2 has been replaced with an external production database.
- Database credentials use least privilege, encrypted transport where applicable, and secret storage.
- No second instance shares the database schema or volumes.
- Database and volume backups have documented, tested restoration procedures.
- CI tokens are narrowly scoped, protected in the CI secret store, and rotated.
- Monitoring covers disk space, memory and heap pressure, Elasticsearch health, analysis queue time, service availability, and backup success.
- Upgrade notes and a rollback plan are reviewed before every tag change.
When one VPS is no longer the right design
A single VPS is appropriate when one application node can handle your project count and analysis concurrency and a brief maintenance window is acceptable. Move to a larger single host when measurements show resource pressure but the availability requirement remains modest. Consider a cluster-oriented Data Center deployment when losing one node must not interrupt service or when sustained workload exceeds a carefully sized single machine. That design requires separate application and search services, coordinated database and storage planning, and materially more operational expertise; it is not a drop-in upgrade for a small VPS.
Frequently Asked Questions
Can I run a code quality server in Docker on a VPS?
Yes. The official Docker image is the shortest path for a single Linux VPS. Set the Elasticsearch host limits first, pin an image tag, map port 9000, and mount separate persistent volumes for data, logs, and extensions.
What VPS size does the server need?
There is no universal size. Requirements vary with repository volume, concurrent analyses, branches, and edition. Use the documented kernel and file-descriptor settings as prerequisites, then size and resize from observed memory, CPU, disk, Elasticsearch health, and queue metrics.
Do I need PostgreSQL for the server?
You need an external production database; the embedded H2 database is not suitable for production. PostgreSQL is a common deployment choice, provided the version and connection settings are supported by your selected release.
Can two containers share one database?
No. Only one instance or cluster may connect to a database schema at a time. Give a test or second instance its own schema and persistent volumes.
Why should the Docker stop timeout be long?
Analyses may still be running when Docker stops the container. A setting such as --stop-timeout 3600 gives the process time to shut down cleanly instead of being killed after Docker’s default ten-second wait.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteThe Bottom Line
A secure single-VPS deployment is practical: choose the right edition, satisfy Elasticsearch host limits, run a pinned Docker image with separate volumes, use an external database, protect port 9000 behind TLS and a firewall, and test both backups and upgrades before calling the system production-ready.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
