Install Dokploy on a VPS with Docker and HTTPS

For a typical project, you might have a frontend, an API and a database, each with different settings and update requirements. Dokploy gives you a place to manage those deployments and inspect their logs while retaining access to the underlying Linux server.

The walkthrough uses two hostnames. panel.example.com is the administration dashboard, and hello.example.com is a small test application. Replace these names and every example IP address with your own values.

What the current Dokploy release adds

These are among the additions in v0.31.0. Check the requirements of each feature as you configure it, and rehearse a service move before scheduling one for a live application. Explore the release announcement.

Choose a VPS for Dokploy and its applications

Dokploy lists 2 GB RAM and 30 GB disk space as its minimum. Application builds, databases and uploaded files need capacity beyond the panel's own workload. Its documented Linux options include Ubuntu 24.04 LTS and Debian 12. Check the installation requirements.

Start on a fresh VPS reserved for Dokploy. The installer configures Docker Swarm and its network, including a forced departure from an existing Swarm. Keeping this installation on a new host makes that change predictable. The commands below describe a single-server deployment.

HYEHOST Cloud VPS and VDS are available in Wolverhampton, Ashburn and Auckland. Match the region to your users and check the plan's resources and transfer allowance. VDS can suit projects that need dedicated resources for sustained work.

1. Prepare DNS and administrator access

Create DNS A records for panel.example.com and hello.example.com, pointing to the VPS's assigned public IPv4 address. Add AAAA records when the corresponding IPv6 route and firewall access work.

• Reserve TCP ports 80 and 443 for Traefik's web traffic and certificate validation.
• Keep SSH restricted to the administrators who need it.
• Before installation, restrict public TCP 3000 using a firewall that filters Docker-published traffic.
• Check access from a separate machine over each IP family configured in DNS.

Port 3000 is the dashboard's initial listener. The installer publishes it on the host, so the bootstrap restriction matters before the first administrator account is created. Docker's networking can bypass ordinary UFW rules. Our existing guide explains the interaction and external checks. Review Docker firewall behaviour.

Use SSH key access and retain a working connection throughout setup. Our VPS checklist covers the host's initial administration tasks. Prepare a Linux VPS.

2. Install the pinned Dokploy release

On the fresh server, download the release's own installer and inspect it. The example address 203.0.113.10 must be replaced with the public IPv4 address actually assigned to your VPS.

mkdir -p ~/dokploy-install
cd ~/dokploy-install
curl --fail --location --output install.sh \
  https://github.com/Dokploy/dokploy/releases/download/v0.31.0/install.sh
less install.sh
sudo env ADVERTISE_ADDR=203.0.113.10 sh ./install.sh

ADVERTISE_ADDR selects the interface address used by Swarm. Passing it through sudo env gives the installer the intended value. The release-specific script installs its matching Dokploy version and prepares the required Docker services.

Resolve any reported installation failure before continuing. Inspect service state and recent panel logs from the server.

sudo docker service ls
sudo docker service ps dokploy
sudo docker service logs --tail 100 dokploy

The installer and version-selection options are documented by the project. Keep the release notes and installation record with your server documentation. Review the versioned installation procedure.

3. Create the administrator account over SSH

On your own computer, open a local SSH forward. Replace admin and the example address with your VPS login details, then keep this terminal open.

ssh -N -L 127.0.0.1:3000:127.0.0.1:3000 admin@203.0.113.10

Open http://localhost:3000 in your browser to complete the initial administrator registration. This connection travels through SSH to the server's dashboard listener. Check that direct access to the server's port 3000 remains restricted by your bootstrap firewall rule.

Set a strong unique administrator password. Once the dashboard has its final HTTPS hostname, enable a passkey or two-factor authentication under Settings → Profile and store the recovery material securely. Read the account security guide.

4. Give the Dokploy dashboard its HTTPS domain

Open Web Server and find the Server Domain settings. Enter panel.example.com in Domain, provide your Let's Encrypt email, enable HTTPS and select Let's Encrypt as the certificate provider. Save the settings.

Check that DNS resolves to the server and wait for certificate issuance. Open https://panel.example.com in a separate browser session and confirm you can sign in through that hostname. The current release's domain form contains these settings. Inspect the panel domain settings.

While accessing the panel through its working domain, use Web Server → Server → Disable Port 3000. Read the confirmation and retain its recovery command. The panel service restarts as the host publication is removed. Verify HTTPS sign-in again afterwards. Review the port control.

Complete an external check that the dashboard hostname works and the server's public port 3000 is closed. The documented hardening guidance covers this network boundary. Read the deployment hardening guide.

5. Deploy a first Docker Compose service

Create a project and choose its environment. Add a Compose service, name it hello and select Docker Compose as the Compose type. Open its Compose editor under the deployment settings.

Use this small web service to verify the deployment path. It serves the standard Nginx welcome page and listens internally on port 80.

services:
  web:
    image: nginx:1.30.6-alpine
    restart: unless-stopped
    expose:
      - "80"

Save the configuration. The example uses an exact image tag checked for this article. Before later updates, review and test the new image version. The official image documentation describes the web server's container layout. Read the Nginx image documentation.

Enable Isolated Deployments in the Compose utilities when you want the service on its own application network. Dokploy connects Traefik to that network for routing. Review Compose network utilities.

6. Connect the application domain and redeploy

Open the Compose service's Domains tab and choose Add Domain. Set the host to hello.example.com, select service web, use container port 80 and enable HTTPS with Let's Encrypt.

Open Preview Compose to inspect the resulting labels and network configuration. Save the domain and deploy the Compose application. After each later domain change, redeploy so Traefik receives the new labels. Follow the Compose domain workflow.

Check the deployment logs and visit https://hello.example.com. You should see the Nginx welcome page with a valid certificate. Test the response from another machine too.

curl --head https://hello.example.com

Traefik handles the public HTTPS connection and forwards traffic to port 80 inside the web container. Inspect HTTP behaviour separately if your application needs an HTTP-to-HTTPS redirect, and configure the appropriate router middleware. Dokploy's domain guide explains the routing mechanisms. Review domain routing.

7. Add your real application settings

Once the test deployment works, create a service for your application's own image or source repository. Record its internal listening port, persistent data paths, required environment variables and startup dependencies.

For Compose deployments, values entered in Dokploy's environment editor are written to a project .env file. Reference the variables the container needs in the Compose configuration, or use an appropriate env_file. Review Compose environment handling.

Keep production credentials in protected configuration and scope repository or registry tokens to the access required. Verify the application can reach its database through the intended internal network. Test sign-in, writes, uploads and background work before sending users to the new hostname.

For build-heavy projects, measure peak RAM and CPU during a deployment. Keep enough disk space for image pulls, build layers and a recovery copy. Those peaks often determine the server size more directly than an idle dashboard.

8. Protect the panel and application data

Dokploy's Web Server → Backups workflow uses an S3 destination for its control database and filesystem archive. Set the schedule and destination, verify completion and perform an isolated restore. Configure Dokploy backups.

Plan application database and volume recovery alongside that control-plane archive. Use a consistent database export or an appropriately stopped service when the file-backup method requires it. The volume-backup documentation covers separate persistent data. Review volume backups.

HYEHOST Storage Box can hold encrypted off-server recovery archives through SFTP and other supported methods. It also offers S3-compatible access in beta. Validate the destination features required by your chosen backup workflow and test recovery before depending on it. Explore Storage Box access methods.

Maintain the VPS and deployment platform

Keep a record of the Dokploy version, operating-system updates and application image versions. Review release changes, back up the affected data and test an upgrade on a separate server before applying it to a live platform.

Use the selected Dokploy release's installer in its documented update mode for a versioned platform update. Treat platform, application and database changes as separate maintenance tasks, with their own verification and recovery steps. Check the update procedure.

Set up external availability checks and deployment-failure notifications. Review disk space, build peaks and backup age regularly. Service transfers and scaling are easier to plan when you already know which resource is reaching its limit.

Troubleshooting the first deployment

Dokploy VPS hosting FAQ