Self-Host Vaultwarden Docker: Ditch the Subscription

I canceled my 1Password subscription eighteen months ago and haven’t looked back. Not because I switched to another SaaS service — because I learned how to self-host Vaultwarden Docker on my homelab, and now my entire password vault runs on hardware I own, encrypted, synced to every device, and costs me exactly zero dollars per month. If you’re paying $36–$60 a year for a password manager and you’ve already got a server or even a Raspberry Pi sitting around, this is one of the best uses of 20 minutes you’ll spend this year.

Vaultwarden is an unofficial, open-source reimplementation of the Bitwarden server API written in Rust. It’s compatible with every official Bitwarden client — the browser extensions, the iOS and Android apps, the desktop apps, the CLI — all of it just works, pointing at your server instead of Bitwarden’s cloud. You get the same interface, the same autofill, the same vault organization. What you don’t get: a monthly bill or reliance on a third party to keep your passwords safe.

Why Self-Host Vaultwarden Docker Instead of Just Using Bitwarden Free?

When you self-host Vaultwarden Docker style, your passwords live on hardware you own — and the subscription line item disappears.

Fair question. Bitwarden’s free tier is genuinely solid — unlimited passwords, cross-device sync, browser extensions. So why bother self-hosting at all?

A few reasons. First, Bitwarden’s premium features — TOTP code generation inside the vault, emergency access, encrypted file attachments, organization sharing — cost $10–$40/year. In Vaultwarden, those are all included at zero cost. It’s one of the reasons the self-hosting community adopted it so fast.

Second, when you self-host Vaultwarden Docker, your encrypted vault data lives on your hardware. Bitwarden uses end-to-end encryption so their servers never see your plaintext — but if Bitwarden shuts down or gets breached, you’re dependent on their response. When it’s your server, you control the backups and the upgrade schedule.

Third, Vaultwarden is tiny. The official Bitwarden server requires 11 Docker containers and 4GB of RAM minimum. Vaultwarden is a single container that idles at around 50MB of RAM. It’ll run on a Raspberry Pi Zero 2W.

What You Need Before You Start

The prerequisites are straightforward:

• A Linux server or mini PC with Docker installed (x86 or ARM64 both work)
• A domain name — even a free subdomain via DuckDNS works fine
• HTTPS — required because Vaultwarden uses the Web Crypto API, which browsers disable on non-HTTPS origins
• A reverse proxy to handle SSL (Nginx Proxy Manager is the easiest option)

If you’re setting this up on dedicated hardware, the Beelink MINI S13 mini PC (Intel N150) is the go-to recommendation for a low-power always-on homelab host. It runs efficiently 24/7, handles Docker with room to spare, and has dual 2.5GbE for proper networking. It can run Vaultwarden, Pi-hole, Uptime Kuma, and several other containers simultaneously without breaking a sweat.

Self-Host Vaultwarden Docker: The Full Setup

Here’s the minimal docker-compose.yml to get Vaultwarden running:

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    volumes:
      - ./vw-data:/data
    environment:
      - DOMAIN=https://vault.yourdomain.com
      - SIGNUPS_ALLOWED=true
    ports:
      - "8080:80"

That gets Vaultwarden running locally on port 8080. But you can’t use it from another device until you add HTTPS. The recommended approach: add Nginx Proxy Manager to the same Compose file, point it at your domain, create a proxy host for vault.yourdomain.com pointing to the Vaultwarden container, and enable Let’s Encrypt SSL. The whole process takes about 10 minutes once you’ve done it once. The official Vaultwarden wiki covers every edge case if you get stuck.

Once it’s up, go to vault.yourdomain.com, create your account, then immediately flip SIGNUPS_ALLOWED to false in your environment. Then install the official Bitwarden browser extension, change the server URL to your domain, and log in. Done — you’re running your own Bitwarden-compatible vault.

3 Security Steps You Shouldn’t Skip

1. Disable open signups immediately. Set SIGNUPS_ALLOWED=false after creating your account. Otherwise anyone who finds your domain can create a vault on your server.

2. Enable 2FA on your vault account. Vaultwarden supports TOTP. Go to account settings in the web vault and set it up. Any TOTP app works — Aegis on Android and the official Bitwarden Authenticator are both solid choices.

3. Back up your vw-data folder automatically. All your vault data lives there. A cron job that syncs it to a second drive or to cloud storage via rclone is all you need. Running a self-hosted password manager without backups is genuinely risky — don’t skip this step.

What to Run It On Long-Term

Self-host Vaultwarden Docker once, back it up properly, and you’ve solved passwords for a decade — on your own terms.

Vaultwarden’s memory footprint is so small that even the cheapest always-on hardware handles it easily. But if you’re building out a full homelab stack and want serious headroom, the GEEKOM Mini IT13 (Intel Core i5-13500H) is worth the step up. Twelve cores, support for 32GB RAM, and dead quiet — it can run Vaultwarden, Grafana, Jellyfin, Home Assistant, and a dozen other containers without any of them competing for resources.

The Takeaway

When you self-host Vaultwarden Docker, you’re not just saving $36 a year — you’re taking real ownership of one of the most sensitive pieces of your digital life. Your passwords live on your hardware, encrypted, accessible from every device through the official Bitwarden clients, with premium features included at no cost. The setup genuinely takes 20 minutes if you’ve already got Docker running somewhere.

The ongoing maintenance is nearly zero — Vaultwarden updates are a one-liner: docker compose pull && docker compose up -d. It’s one of those self-hosting projects where the effort-to-payoff ratio is almost embarrassingly good. If you’re new to Docker-based self-hosting, our guide to 5 Docker containers every beginner should run first pairs perfectly with this one — Vaultwarden makes an obvious first addition to that list.

Your Turn

Already running Vaultwarden? What reverse proxy are you using, and what else is in your container stack? Drop it in the comments — always curious how others have set up their homelab stack around it.

One security note worth repeating: your master password becomes the single key to everything, and no one can reset it for you — that’s the point of self-hosting it. Write it down, store it somewhere physically safe, and turn on two-factor for the web vault. Self-hosted means self-responsible, and with passwords that’s a feature, not a burden.

Frequently Asked Questions

Is Vaultwarden safe to use instead of the official Bitwarden server?

Yes — it’s fully compatible with the official Bitwarden browser extensions, mobile apps, desktop apps, and CLI, and the self-hosting community has adopted it widely specifically because it implements the same client-facing API and encryption model.

How much RAM does Vaultwarden actually need?

Very little — it idles around 50MB and will run on a Raspberry Pi Zero 2 W. Compare that to the official Bitwarden server, which needs 11 Docker containers and 4GB of RAM minimum.

Do I need a domain name to self-host Vaultwarden Docker?

Yes, at minimum a free subdomain like one from DuckDNS, plus HTTPS. Vaultwarden relies on the Web Crypto API, which browsers disable on non-HTTPS origins, so a reverse proxy like Nginx Proxy Manager for SSL is required, not optional.

What’s the most important security step after setup?

Disable open signups immediately by setting SIGNUPS_ALLOWED=false once your account is created. Without that, anyone who finds your domain could create their own vault on your server.

What hardware do I need to self-host Vaultwarden Docker?

Almost anything with Docker. A low-power mini PC like the Beelink MINI S13 is more than enough for Vaultwarden alone, and can comfortably run several other lightweight containers alongside it.