Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
To self-host Bitwarden with Docker, use a Linux machine with Docker Engine 26 or newer, a domain that resolves to the machine, inbound ports 80 and 443, and a signed TLS certificate. Before installation, request an installation ID and key from Bitwarden. Then choose Standard, the multi-container x64 deployment, or Lite, the single-container deployment that also supports ARM64 hardware such as a Raspberry Pi.
What a self-hosted Bitwarden deployment includes
Self-hosting places the Bitwarden server and its supporting services on infrastructure you administer. Your clients still connect through the Bitwarden applications, but the server endpoint, operating-system updates, Docker runtime, certificates, firewall and backups become your responsibility.
There are two current deployment paths:
- Standard: a multi-container installation intended for larger or more demanding deployments. The official implementation requires an x64 processor.
- Lite: a single-container installation designed for personal or small-team use. It runs on x64 and ARM64, making it suitable for compatible Raspberry Pi systems.
Both paths require Docker Engine 26 or newer. Current Docker Engine packages include Docker Compose as a plugin, so a separate legacy Compose installation should not be necessary.
Standard or Lite: which should you choose?
| Characteristic | Standard | Lite |
|---|---|---|
| Container layout | Multiple containers | Single container |
| Minimum memory | 2 GB RAM | About 200 MB RAM |
| Recommended memory | 4 GB RAM | Not stated |
| Minimum storage | 12 GB | 1 GB |
| Recommended storage | 25 GB | Not stated |
| Processor architecture | x64 only | x64 or ARM64 |
| Best fit | Larger installations and teams needing the full multi-container deployment | Personal vaults, small teams and modest ARM64 hosts |
| Database arrangement | Includes the default database container; an external database is possible | Uses the database arrangement supplied by the Lite package |
The Standard figures are published minimums and recommendations, not performance guarantees. A small-team administrator may reasonably provision two virtual CPUs and 4 GB of RAM, but those higher figures are recommendations rather than the official minimum. Do not treat older guides that list Docker 20.10.x or 24.x as current requirements; use Docker Engine 26 or newer.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Prerequisites to complete before installing
1. A supported Linux host
Use a maintained Linux distribution on a machine you can patch and monitor. Create a normal administrative account and run the Bitwarden installer as that user, not as root. Confirm the host architecture before choosing a package:
uname -m
docker --version
docker compose versionStandard requires an x64 result from uname -m (commonly x86_64). Lite can use x64 or ARM64 (commonly aarch64). Install Docker Engine 26 or newer using the instructions for your distribution, then enable its service and verify that the Docker daemon starts after reboot.
Free tools Windows power users keep installed
One-click scans. No signup required.
2. Sufficient memory and storage
For Standard, reserve at least 2 GB of RAM, a 1.4 GHz x64 processor and 12 GB of storage. Bitwarden’s recommended Standard allocation is 4 GB of RAM and 25 GB of storage, which leaves room for container layers, logs and database growth. Lite’s published floor is approximately 200 MB of RAM and 1 GB of storage. These are deployment requirements; they do not include the operating system, Docker’s image cache, monitoring or your backup copies.
3. A DNS name pointing to the host
Create an A record for an IPv4 address, and an AAAA record only when IPv6 is correctly routed and firewalled. The name must resolve to the host before you start certificate issuance or the installer may fail validation. Check resolution from another network:
dig +short vault.example.net
# or
nslookup vault.example.netReplace vault.example.net with the name you will use for Bitwarden. If the host is behind a router, forward TCP ports 80 and 443 to it; forwarding only one of those ports is not sufficient for the normal certificate-validation flow.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
4. Ports 80 and 443 available
- TCP 80: used for HTTP access and certificate validation.
- TCP 443: used for encrypted HTTPS access by the web vault and clients.
Stop or reconfigure any existing web server, reverse proxy or control panel that already binds these ports. If a cloud firewall and a host firewall are both enabled, allow the ports in both places.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall5. A signed TLS certificate
Bitwarden requires a signed certificate. Let’s Encrypt is the usual no-cost certificate authority route, and it requires a domain that can be validated. You can instead supply a certificate issued by another trusted authority. Plan renewal before the first certificate expires; an expired certificate can prevent clients from synchronizing even when the containers are healthy.
6. An installation ID and key
Request the installation ID and key through Bitwarden’s self-host portal using an email address before starting the deployment. Keep both values private. They identify the installation process and should be stored in a password manager or another protected administrative record, not in a public repository or shell history.
Prepare the host safely
- Create a dedicated account. Use your distribution’s user-management tools to create a non-root account for the deployment. Give it administrative access only through your normal
sudopolicy. - Allow Docker access. Add the account to the Docker group only if your security policy accepts the privilege implications; membership effectively grants root-equivalent control of the host. Log out and back in so the new group membership takes effect.
- Make a working directory. For example:
mkdir -p ~/bitwarden
cd ~/bitwarden- Verify versions and architecture. Run
uname -m,docker --versionanddocker compose version. Do not proceed if Docker is older than 26 or if the architecture is incompatible with your selected deployment. - Apply updates and firewall rules. Patch the operating system, permit SSH from trusted addresses, and allow inbound TCP 80 and 443. Keep the Docker API socket off the public internet.
- Check name resolution from the host and an external network. A local hosts-file entry can hide a broken public DNS record, so test using a device that is not relying on that override.
Install Bitwarden Standard
1. Download the current Standard bundle
From Bitwarden’s self-hosting portal and documentation, obtain the current Standard installer bundle. Place it in the dedicated, non-root working directory and inspect the extracted files before running anything. Do not mix Standard files with a Lite installation.
2. Run the bundled installer
Bitwarden’s Standard bundles traditionally include an installer script with an install action. Use the exact entry point and options supplied with the version you downloaded; in bundles that provide the familiar script, the command is:
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
cd ~/bitwarden
./bitwarden.sh installDuring setup, enter the fully qualified domain name, your installation ID and installation key, and the certificate choice requested by the installer. If the current bundle uses a different command or prompts, follow that bundle’s instructions rather than forcing the example above.
3. Let the installer create the multi-container stack
Standard provisions several cooperating containers and a Docker Compose configuration. The default database is an MSSQL Express image. That default relational database has a 10 GB maximum database size. An external database is possible when your operational requirements exceed the bundled arrangement, but it adds separate patching, network, credentials and backup responsibilities.
When the installer finishes, start the generated stack using the command shown by the bundle. A Compose-based installation commonly uses:
docker compose up -dUse the generated project directory, not an arbitrary directory containing another Compose file. Check that all services are running:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →docker compose ps
docker compose logs --tail=1004. Test HTTPS before enrolling clients
Open the chosen domain over HTTPS from a device outside the server’s network. Confirm that the certificate name matches the domain, the browser shows a valid trust chain, and the web vault loads. Only after that test should you configure desktop or mobile clients to use the self-hosted server URL.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Install Bitwarden Lite
1. Confirm ARM64 or x64 compatibility
Lite supports both x64 and ARM64, unlike Standard. This makes it the practical Bitwarden deployment for a compatible Raspberry Pi or another ARM64 Linux host. Check uname -m and confirm that the Docker images supplied with the Lite release support the result.
2. Obtain the Lite package and credentials
Download the current Lite package from Bitwarden’s self-hosting instructions, then supply the installation ID and key obtained through the self-host portal. Keep the package in its own directory; Lite’s configuration and container lifecycle are not interchangeable with Standard’s multi-container files.
3. Run the Lite installer exactly as packaged
Lite releases can change their wrapper command and configuration prompts. Start the installer entry point included with the package, provide the domain, credentials and certificate settings it requests, and allow it to create the single container. Do not copy a Standard Compose file onto an ARM64 host or substitute a legacy Docker command from an older guide.
4. Verify the container and endpoint
docker ps
docker logs --tail=100 <lite-container-name>Use the actual container name shown by the package. Resolve the domain externally, browse to its HTTPS address, and verify that synchronization works from one client before adding additional users or devices.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Certificate, DNS and reverse-proxy pitfalls
When certificate validation fails
- Check that the DNS record has propagated to the public address rather than a private address.
- Confirm that TCP 80 reaches the Bitwarden host without another service answering first.
- Check the system clock; large clock errors can invalidate certificate operations.
- Review the installer and proxy logs for the exact challenge or permission error.
When HTTPS works locally but not remotely
Test from a mobile connection or another external network. A successful request from the server itself can be caused by split-horizon DNS, a local hosts entry or hairpin NAT and does not prove that public users can connect. Check the cloud security group, router forwarding and host firewall independently.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
When ports are already occupied
sudo ss -ltnp | grep -E ':80|:443'Identify the process holding each port. Reconfigure it to use another listener, place it in front of Bitwarden as a deliberately configured reverse proxy, or stop it. Running two unrelated services that both expect to terminate TLS on 443 will not work without explicit routing.
Database and storage planning
Standard’s default MSSQL Express database is capped at 10 GB of relational data. Monitor growth rather than waiting for the limit to be reached. An external database can remove that particular ceiling, but it does not remove the need for backups, upgrades, access control and tested recovery.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Keep free disk space beyond the published minimum. Docker needs space for image layers and temporary files, while the database, attachments, logs and backup archives grow independently. Store backups on a separate system or storage account; a second copy on the same disk does not protect against disk failure or host loss.
Updates, backups and day-to-day operation
Before every upgrade
- Record the currently running Bitwarden and Docker versions.
- Export or snapshot the database using the method appropriate to your deployment.
- Confirm that a recent backup can be read and that you know where the recovery credentials are kept.
- Read the release notes for breaking changes to the installer, images or environment variables.
After an upgrade
- Check container status with
docker compose psfor Standard ordocker psfor Lite. - Inspect recent logs for crash loops, failed migrations or certificate errors.
- Open the web vault over HTTPS and sign in with a test account.
- Synchronize one client and verify that a newly created test item appears on the server.
Do not delete the previous image or backup immediately after an upgrade. Keep a rollback path until the test login and synchronization checks succeed.
Troubleshooting by symptom
| Symptom | Likely cause | First checks |
|---|---|---|
| Installer rejects the domain | DNS does not point to the host or has not propagated | Query the record externally; verify the public IP and any IPv6 route |
| Certificate issuance times out | Port 80 is blocked or another service answers the challenge | Check router forwarding, cloud firewall, host firewall and listeners on port 80 |
| Browser reports an untrusted certificate | Wrong certificate, incomplete chain or a name mismatch | Inspect the certificate’s subject and chain; ensure it covers the exact hostname |
| Containers repeatedly restart | Insufficient memory, invalid configuration or failed database startup | Review recent logs, available RAM and the generated environment settings |
| Standard will not start on a Raspberry Pi | Standard is x64-only | Use Lite on supported ARM64 hardware or move Standard to an x64 host |
| Clients cannot synchronize although the vault opens | Incorrect server URL, certificate trust issue or proxy path problem | Use the exact HTTPS hostname, test from the client network and inspect proxy logs |
| Database growth approaches the limit | The bundled MSSQL Express database is nearing its 10 GB relational-data maximum | Review retention and storage, back up, and evaluate the supported external-database option |
Security checklist for a production host
- Run the installer as a non-root user and keep the operating system patched.
- Expose only the required public services, normally HTTPS on 443 and HTTP on 80 for certificate validation.
- Restrict SSH and administrative interfaces to trusted networks or a VPN.
- Protect the installation ID, key, database credentials and backup encryption keys.
- Use a valid certificate and plan automated renewal before expiry.
- Monitor disk, memory, certificate dates and container health.
- Maintain encrypted, off-host backups and perform a recovery test at intervals you can document.
- Never publish Docker’s control socket or an administrative Compose file on the public internet.
Which deployment is the sensible default?
Choose Lite when the host is ARM64, when the vault is personal or used by a small team, or when you deliberately want the lower published resource floor and one-container administration. Choose Standard when you have an x64 host, need the full multi-container layout, expect a larger installation, or want the option of integrating an external database. In either case, Docker Engine 26 or newer, a resolvable domain, ports 80 and 443, a signed certificate, and an installation ID and key are non-negotiable starting requirements.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
