A private cloud used to mean a full NAS, a rack, and a monthly power bill worth noticing. In 2026 it can mean a 100-dollar mini-PC in a cupboard running three or four Docker containers that fit inside 512 MB of RAM combined. The trick is picking containers that do one thing well, not the enterprise sprawl that assumes 32 GB and a Xeon.
We tested eight lightweight self-hosted containers that turn a cheap always-on box into a real private cloud: passwords, files, photos, monitoring, remote access, and reverse-proxied HTTPS across the whole stack. Ranked by RAM footprint under normal load and the setup effort it takes to get a green padlock in the browser.
What to look for in a lightweight container
- Small idle footprint. Under 100 MB of RAM at rest is a fair line. Some of these use under 20 MB.
- Single-container image. No sidecars, no separate database service, no Java runtime.
- Sensible defaults. The first-run wizard should produce a working, encrypted service without a config file dive.
- Active upstream. A dead project on the internet is a security incident waiting to happen.
- Reverse-proxy friendly. Every service should sit behind Nginx Proxy Manager or Caddy for HTTPS, not expose a raw port.
- Escape hatch. Exports and backups are documented. You are not locked in.
Quick comparison
| Container | Best for | Idle RAM | License | Multi-arch |
|---|---|---|---|---|
| Uptime Kuma | Status page + alerts | ~60 MB | MIT | Yes |
| Vaultwarden | Passwords | ~15 MB | AGPLv3 | Yes |
| Nginx Proxy Manager | HTTPS front door | ~50 MB | MIT | Yes |
| FileBrowser | File uploads and shares | ~10 MB | Apache 2.0 | Yes |
| Immich | Photo library | ~500 MB | AGPLv3 | Yes |
| Dozzle | Container logs UI | ~20 MB | MIT | Yes |
| Tailscale | Zero-config VPN | ~30 MB | BSD-3 | Yes |
| Portainer | Container manager | ~120 MB | zlib | Yes |
The apps
1. Uptime Kuma, status page and alerts
Uptime Kuma is the free Pingdom you host yourself. Point it at every URL, container, and Docker socket you care about, pick a notification channel, and it pings on a schedule. The UI is a single page you can drop on a home dashboard. When a service goes down at 2 a.m., Uptime Kuma is the container that wakes you up.
Where it falls short: Push notifications need a bridge (Ntfy, Gotify, or Discord). No native mobile app.
Pricing: Free.
Platforms: Linux, macOS, Windows via Docker Desktop, Raspberry Pi.
Download: Uptime Kuma on GitHub.
Bottom line: Install first. Everything you self-host benefits from being watched.
2. Vaultwarden, passwords for the household
Vaultwarden is the Bitwarden-compatible server rewritten in Rust. Fifteen megabytes of RAM at idle, one SQLite file for the vault, and every Bitwarden client (mobile, desktop, browser) works against it without a hint that it is not the real thing. Turning on WebAuthn takes one config toggle.
Where it falls short: Not officially supported by Bitwarden. If a Bitwarden update ships a breaking API change, Vaultwarden takes a few days to catch up.
Pricing: Free.
Platforms: Linux, macOS, Windows via Docker Desktop.
Download: Vaultwarden on GitHub.
Bottom line: The single biggest self-hosted win for a household. Small, safe, and cheap.
3. Nginx Proxy Manager, HTTPS front door
Nginx Proxy Manager wraps Nginx in a web UI. Add a proxy host, tick “request a Let’s Encrypt certificate,” and every other service in your stack gets HTTPS with no hand-edited config. Access lists control which sources see which services, and streams handle non-HTTP protocols.
Where it falls short: Not the right pick if you already know Caddy. Caddy is a smaller single binary and easier to script.
Pricing: Free.
Platforms: Linux, macOS, Windows via Docker Desktop.
Download: Nginx Proxy Manager on GitHub.
Bottom line: The easiest way to put a green padlock on everything else.
4. FileBrowser, file uploads and shares
FileBrowser exposes a folder over HTTPS with a browser UI, user accounts, and shareable links. Ten megabytes of RAM. No database. Ten seconds to first upload. When someone in the household needs to grab a file from anywhere, this is the container that answers.
Where it falls short: Not a full sync client. Use Syncthing for two-way sync, FileBrowser for pull-based downloads and quick shares.
Pricing: Free.
Platforms: Linux, macOS, Windows.
Download: FileBrowser on GitHub.
Bottom line: The lightest way to make “here, download this” work without a cloud drive.
5. Immich, photo library
Immich is the self-hosted Google Photos clone that finally became credible in the last year. Faces, AI search, timeline sync from iOS and Android, and a machine-learning worker that runs on the same box. Under half a gigabyte of RAM for a small library, more for the ML worker if you point it at a large one.
Where it falls short: Immich is still labelled unstable by its own maintainers. Keep backups and read release notes before every upgrade.
Pricing: Free.
Platforms: Linux, macOS via Docker Desktop.
Download: Immich on GitHub and the Immich website.
Bottom line: The current answer for people who want off Google Photos without giving up the auto-organised timeline.
6. Dozzle, container logs in a browser
Dozzle streams Docker container logs to a browser tab. Twenty megabytes of RAM, zero config. When Vaultwarden or Immich misbehaves, Dozzle is faster to open than SSH-ing in and running docker logs.
Where it falls short: Only shows current logs. Not a log aggregator, not a search engine over history.
Pricing: Free.
Platforms: Linux, macOS, Windows via Docker Desktop.
Download: Dozzle on GitHub.
Bottom line: The debugging container. Install it once, thank yourself later.
7. Tailscale, zero-config VPN
Tailscale is not open source at the client, but the coordination service can be replaced by the self-hosted Headscale project. In practice, the free Tailscale plan covers three users and a hundred devices, which is enough for a household plus a handful of always-on services. Every container in the stack becomes reachable by name from any device signed into the Tailnet, without opening a router port.
Where it falls short: Trust in Tailscale’s coordination plane. If that is a dealbreaker, run Headscale instead.
Pricing: Free for personal use up to three users and a hundred devices.
Platforms: Linux, macOS, Windows, iOS, Android.
Download: Tailscale on GitHub and the Tailscale website.
Bottom line: The container that means you never open a router port again.
8. Portainer, container manager for the whole stack
Portainer is the web UI over Docker. Add a container, edit an env var, restart a stack, watch resource usage. Community Edition is free and covers what most home labs need. Above 100 MB of RAM but earns it back by making the CLI optional.
Where it falls short: Heaviest container in this list. Skip it if you are comfortable with docker compose in a terminal.
Pricing: Free Community Edition. Paid Business Edition for larger deployments.
Platforms: Linux, macOS, Windows.
Download: Portainer on GitHub and the Portainer website.
Bottom line: The friendly control panel. Install if you want to click, skip if you prefer to type.
How to pick the right one
- You want the smallest possible private cloud: Vaultwarden, FileBrowser, Nginx Proxy Manager. Three containers, under 100 MB of RAM combined.
- You have a working stack and want it monitored: Uptime Kuma plus Dozzle.
- You want off Google Photos: Immich. Budget more RAM than the others.
- You do not want to open a router port: Tailscale. Everything else stays private on the Tailnet.
- You prefer clicking to typing: Portainer.
FAQ
What hardware do I need for a lightweight Docker stack?
An Intel N100 mini-PC with 8 GB of RAM handles all eight of these containers with room to spare. Under 100 dollars new, under 60 second-hand.
Do I need a domain name?
For internal-only use, no. For anything you want to reach from a phone by name with HTTPS, yes. Cloudflare, Namecheap, and Porkbun all sell working domains for around 10 dollars a year.
Is Docker Compose enough or do I need Kubernetes?
Docker Compose is enough for a home lab. Kubernetes solves problems you do not have and creates several you do not want.
How do I back up all of this?
Bind-mount every container’s data directory to one folder, then back up that folder with Restic, Borg, or Duplicati. Test the restore.
What breaks first when I add too many containers?
RAM, then IOPS on the boot drive if it is a slow eMMC. The eight containers here fit inside 1 GB combined. Ten more casual ones fit inside 4.
