How to install Dokploy on a VPS securely

Dokploy is a self-hosted deployment platform built around Docker Swarm and Traefik. It can deploy applications and Compose projects, manage databases, issue certificates, run builds, and store provider credentials. Its dashboard is therefore infrastructure access, not an ordinary website admin page.

This guide installs Dokploy on a fresh Ubuntu 24.04 LTS LayerOne VPS, restricts the temporary port 3000 setup screen, serves the panel through HTTPS, and then uses Dokploy's official command to remove direct IP-and-port access.

Dokploy VPS requirements and LayerOne cost

Dokploy documents the 2-GB and 30-GB minimum. It does not prescribe one CPU profile for every project; the CPU ranges above are planning estimates, not guarantees. A source build, database import, or several simultaneous deployments can consume every available core and much more disk than an idle panel. Measure with docker stats, Dokploy monitoring, docker system df, and VPS monitoring guide.

The LayerOne monthly equivalent assumes a continuously existing VPS. Billing is hourly, while transfer, retained backups, and optional services can vary. Check Pricing before ordering.

Supported setup and required ports

Dokploy's current installation guide lists Ubuntu 18.04, 20.04, 22.04, 23.10, and 24.04; Debian 10 through 12; Fedora 40; and CentOS 8/9 among tested systems. The walkthrough below uses a fresh Ubuntu 24.04 LTS VPS with a public IPv4 address.

The single-node installation needs these ports free:

• TCP 80 for Traefik HTTP and ACME validation;
• TCP 443 for Traefik HTTPS;
• optional UDP 443 for HTTP/3 on the current Traefik container; and
• TCP 3000 for the temporary Dokploy web interface.

Do not open Docker Swarm management or overlay-network ports to the internet for this single-node setup. Add them only for a deliberate multi-node design, restricted to the participating server addresses.

Complete Your first hour on a new server, point a DNS record such as dokploy.example.com at the VPS, then confirm required ports are unused:

sudo ss -tulpn | grep -E ':(80|443|3000)[[:space:]]' || true
df -h /
free -h

1. Configure narrow installation firewall rules

On the LayerOne Networking tab, set inbound policy to DROP, outbound to ACCEPT, and add:

See The cloud firewall. Port 3000 must never be an unrestricted permanent admin endpoint.

Mirror the policy inside Ubuntu:

sudo apt update
sudo apt install -y curl ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow from YOUR.ADMIN.IP.ADDRESS to any port 22 proto tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow 443/udp
sudo ufw allow from YOUR.ADMIN.IP.ADDRESS to any port 3000 proto tcp
sudo ufw enable
sudo ufw status verbose

Replace YOUR.ADMIN.IP.ADDRESS. Dokploy's own security guidance warns that Docker-published ports can bypass UFW because Docker edits iptables directly. The LayerOne cloud firewall filters before the guest and remains the dependable boundary.

2. Run the official Dokploy installer

The official installer must run as root and installs Docker if needed:

curl -sSL https://dokploy.com/install.sh | sudo sh

Piping a current script into a root shell is convenient but grants that URL full control of the host. For a reviewed installation, download the same script, inspect it, then execute the local copy:

curl -sSL https://dokploy.com/install.sh -o /tmp/dokploy-install.sh
less /tmp/dokploy-install.sh
sudo sh /tmp/dokploy-install.sh

Dokploy initializes Docker Swarm, creates its overlay network and PostgreSQL service, starts the Dokploy service, and starts Traefik on 80/443. Verify every layer:

docker version
docker info --format '{{.Swarm.LocalNodeState}}'
docker service ls
docker service ps dokploy --no-trunc
docker ps --format 'table {{.Names}}    {{.Status}} {{.Ports}}'
curl -fsSI http://127.0.0.1:3000

The Swarm state should be active, the Dokploy service should converge, and Traefik should be running. Inspect recent logs if it does not:

docker service logs --tail=100 dokploy
docker logs --tail=100 dokploy-traefik

3. Create the owner before anyone else can

From the administration source allowed by the firewall, open http://SERVER_IP:3000. Create the first administrator immediately with a unique password. Enable any available MFA and notification controls, and remove unused users or provider integrations.

Deploy a tiny test container and inspect its build, logs, health, and route. A successful dashboard login alone does not validate the Docker Swarm scheduler or Traefik.

4. Configure the dashboard domain and HTTPS

In Dokploy, add dokploy.example.com as the panel domain and request a Let's Encrypt certificate according to the official Domains guide. Confirm the DNS record resolves to this VPS first.

Verify from a private browser window and the command line:

curl -fsSI https://dokploy.example.com

Test login, logout, a deployment, live logs, and any real-time UI feature on the HTTPS hostname. Do not remove direct port access until that complete path works.

Then run Dokploy's official hardening command to remove port 3000 from the Swarm service:

docker service update --publish-rm "published=3000,target=3000,mode=host" dokploy
docker service inspect dokploy --format '{{json .Endpoint.Ports}}'

Remove TCP 3000 from the LayerOne cloud firewall and UFW:

sudo ufw delete allow from YOUR.ADMIN.IP.ADDRESS to any port 3000 proto tcp
sudo ufw status verbose

Test from outside the administrator network. HTTPS should work; direct port 3000 should fail:

curl -fsSI https://dokploy.example.com
curl --connect-timeout 5 -I http://SERVER_IP:3000

Recheck the service's published ports after every Dokploy update. If an update recreates port 3000, the LayerOne firewall should still block it, and you should remove the publication again.

5. Keep application and database ports private

Route public websites through Dokploy's Traefik on 80/443. In Compose projects, prefer internal service networking and configured domains over publishing host ports. Do not expose PostgreSQL 5432, Redis 6379, Docker 2375/2376, metrics, or framework debug ports.

Inspect the real host surface after each deployment:

docker service ls
docker ps --format 'table {{.Names}}    {{.Ports}}'
sudo ss -tulpn | grep -vF '127.0.0.1' | grep -vF '[::1]'

Dokploy's current Compose guidance recommends named volumes when you need its volume-backup feature. Use its managed ../files area for supported bind-mount workflows; do not assume a repository checkout is persistent across auto-deployments.

6. Manage build capacity and disk growth

Watch a real deployment:

docker stats
docker system df
df -h / /var/lib/docker /etc/dokploy
free -h

Limit concurrent builds to a number this server can sustain, cap application resources, configure log rotation, and schedule safe Docker cleanup. Never use docker system prune --volumes as routine housekeeping: named volumes can hold production databases. If builds repeatedly exhaust the 4-GB server, build in CI and deploy prebuilt registry images or add a separate Dokploy remote server.

7. Back up Dokploy and the workloads separately

Dokploy's Web Server → Backups feature can save the Dokploy PostgreSQL database and /etc/dokploy filesystem together to an S3 destination. Configure a destination, create a backup, confirm the object exists, and test the official restore process on an isolated host.

That control-plane backup does not automatically prove every deployed workload is recoverable. Configure separate database dumps and named-volume backups in Dokploy, copy them to off-server S3-compatible storage, and test restoration. Bind-mounted application data needs its own copy method.

Protect S3 credentials and backup archives as production secrets. A successful upload proves a file was written, not that the database or volume can be restored. LayerOne does not take VPS backups; read Backups and snapshots.

8. Update Dokploy safely

Create and verify control-plane and workload backups, read the Dokploy release notes, then use the official stable update command:

curl -sSL https://dokploy.com/install.sh | sudo sh -s update

For strict change control, the official installation page also documents version-specific release installer URLs. Keep the old version and backup until the panel and representative applications pass checks.

After updating:

docker service ls
docker service ps dokploy
docker service logs --tail=100 dokploy
docker ps --filter name=dokploy-traefik
curl -fsSI https://dokploy.example.com
docker service inspect dokploy --format '{{json .Endpoint.Ports}}'

Dokploy does not automatically update its Traefik container during a normal Dokploy update. Change Traefik only after checking the Dokploy documentation and Traefik release compatibility; an incompatible manual upgrade can break routing.

Security pitfalls

• Limit Dokploy administrators and integrations. Dashboard access can deploy code, reveal secrets, and control connected servers.
• Restrict SSH in both firewalls, use keys, and keep the browser console as a recovery path.
• Treat environment variables, Git-provider tokens, S3 credentials, Dokploy backups, and /etc/dokploy as sensitive.
• Review auto-deploy branches and webhook sources. A compromised repository or deployment token can become code execution on the VPS.
• Never rely on UFW alone for Docker-published services.
• Keep Ubuntu, Docker, application images, and dependencies patched; Dokploy's update does not automatically secure every workload.

Official and LayerOne references

• Official Dokploy installation, ports, hardening, and updates
• Official Dokploy manual installation details
• Official Dokploy security guidance
• Official Dokploy control-plane backups
• Official Dokploy database backups
• LayerOne cloud firewall
• Running Docker
• Monitor your VPS and configure alerts