PocketBase Hosting on Your Own VPS

PocketBase is an open-source backend in a single program: a SQLite database with a REST and realtime API, user authentication, file storage and an admin dashboard, ready for a web or mobile app. Choose it with a plan, pay, and we build the VPS (KVM, NVMe, Ubuntu 24.04 LTS) and install it in a couple of minutes. You get:

• PocketBase 0.40.6 (MIT), built on your server from the official release with its checksum verified, since upstream publishes no official container image.
• An HTTPS address like yourname-x7k2.devoster.app, with the admin dashboard at /_/ and the API under /api/.
• Your superuser already created, logging in with your Devoster account email and a generated password shown in the dashboard. PocketBase's first-run installer link is never reachable from the internet.
• Your data in plain folders under /opt/devoster/data/pocketbase: pb_data, pb_public, pb_migrations and pb_hooks.
• Dashboard controls to open the app, reset the superuser password, restart, stop or start it, read its logs, run an update and connect your own domain.

The app is free; you pay only the VPS plan, with 10% off yearly. The server comes with full root, free nightly backups kept 3 days plus one snapshot, a dedicated IPv4, 1 Gbps with unlimited bandwidth and DDoS protection. Already have a Devoster VPS? Install PocketBase on it from VPS Control, after a quick check of the OS, ports 80 and 443 and free disk, or reinstall the server with it; both are free. Other apps that install this way are on the One-Click Apps page.

You model your data as collections in the admin dashboard, and PocketBase serves them over its API right away:

• A database with an API. Collections are SQLite tables with a REST API for listing, filtering, creating and updating records.
• Realtime subscriptions. Clients can subscribe to a collection or a record and get changes as they happen, for chats, live dashboards and collaborative screens.
• Auth for your app's users, with email and password and OAuth2 sign-in through providers you configure.
• File storage on record fields, kept on the VPS disk.
• API rules per collection that decide who can list, view, create, update or delete.

PocketBase has official JavaScript and Dart SDKs, and any language can call the REST API. Two kinds of accounts: superusers manage PocketBase in the dashboard; your app's users live in the users collection. That collection allows public sign-up by default, because that is what most apps need. If yours shouldn't, change the collection's create rule.

The four folders under /opt/devoster/data/pocketbase are how you extend this install. Copy files in over SSH or SFTP:

• pb_hooks for JavaScript hooks (*.pb.js): custom routes, validation, actions when a record changes, scheduled jobs.
• pb_migrations for JavaScript migrations, so your collections' schema is versioned and reproducible.
• pb_public for static files served at the root of your address. Put your front end's build here and the app and its API share one domain.
• pb_data holds the databases and uploaded files. Leave it to PocketBase.

Restart the app from the dashboard after changing hooks or migrations. This install runs the official PocketBase build with JavaScript hooks; using PocketBase as a Go framework means compiling your own binary, which is outside the one-click app.

PocketBase is one Go program with an embedded database, light enough for the smallest plan. Its memory use is capped to a share of the plan's RAM. What grows is disk, with uploaded files, and CPU, with heavy realtime traffic or busy hooks.

SQLite runs on one server, so PocketBase grows by moving to a bigger plan, which you can do from the panel without reinstalling. If you expect to need several application servers behind a load balancer, a backend built on a client-server database fits better.

PocketBase sends verification emails, password-reset links and one-time codes to your app's users. Outbound mail ports are blocked by default on Devoster VPS plans and no mail server is configured, so those emails don't go out until you set one up:

• Use an external email provider's SMTP relay. Enter its settings in the PocketBase dashboard's mail settings and ask us to open the provider's submission port; it is opened after a short approval.
• Or call a provider's HTTPS API from a hook for your own messages; HTTPS-based mail services work without any port being opened.

Until then, sign-up with email and password still works; only the flows that depend on email don't. Your own superuser password is reset from the Devoster dashboard, with no email involved.

PocketBase is still before version 1.0, and its author says so plainly: a minor version can change the JavaScript hook and migration APIs. So we read each release's changelog before rolling it out, then apply it in a maintenance hour you choose, or when you press Update now. A snapshot of the VPS is taken first, and if PocketBase doesn't come back healthy the server is rolled back automatically. If your app leans heavily on hooks, you can switch auto-update off and update after checking your code against the changelog.

PocketBase is MIT-licensed. Devoster isn't affiliated with the project.

The server is unmanaged: you have full root, and its security, your collections' API rules and your users' data are your responsibility. Nightly backups (3 days) cover the whole VPS; PocketBase's own backups in its dashboard are a second layer. We don't help design your schema or write hooks; PocketBase's documentation covers that.