Host Home Assistant on a VPS: Secure Docker Guide

Updated 7 November 2026 · Standard formula, shown below

This guide walks you through hosting Home Assistant on a virtual private server (VPS) using Docker, with a focus on security. You’ll end up with a remotely accessible smart home hub that runs in an isolated container, protected by firewalls, SSL, and automatic updates.

What You’ll Need

A VPS with at least 2 GB RAM, 20 GB storage, and a public IP address (Ubuntu 22.04 or Debian 12 recommended).
SSH access to the VPS (root or a user with sudo privileges).
A domain name pointing to your VPS’s IP address (for SSL certificates).
Basic familiarity with the Linux command line.

Step-by-Step

Connect to your VPS via SSH: ssh user@your-server-ip. Update the system: sudo apt update && sudo apt upgrade -y.
Install Docker using the official convenience script: curl -fsSL https://get.docker.com -o get-docker.sh && sudo sh get-docker.sh. Verify with docker --version.
Create a dedicated user (optional but recommended) to run Docker commands without root: sudo usermod -aG docker $USER, then log out and back in.
Set up a firewall using UFW. Allow SSH, HTTP, and HTTPS: sudo ufw allow OpenSSH, sudo ufw allow 80/tcp, sudo ufw allow 443/tcp, then enable with sudo ufw enable.
Create a directory for Home Assistant: mkdir -p ~/homeassistant/config.
Run the Home Assistant container with the following command (replace your-domain.com with your actual domain):
```
docker run -d \
  --name homeassistant \
  --restart=unless-stopped \
  -e TZ=America/New_York \
  -v ~/homeassistant/config:/config \
  --network=host \
  --privileged \
  ghcr.io/home-assistant/home-assistant:stable
```
Note: --privileged is required for some integrations (e.g., USB devices). If you don’t need those, omit it for better security.
Verify the container is running: docker ps. Check logs with docker logs homeassistant.
Install Nginx as a reverse proxy to handle SSL and forward requests to Home Assistant: sudo apt install nginx -y.

Create an Nginx configuration for your domain. Edit /etc/nginx/sites-available/homeassistant with:

server {
    listen 80;
    server_name your-domain.com;
    location / {
        proxy_pass http://localhost:8123;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Enable it: sudo ln -s /etc/nginx/sites-available/homeassistant /etc/nginx/sites-enabled/ and test: sudo nginx -t.

Install Certbot for SSL: sudo apt install certbot python3-certbot-nginx -y, then run sudo certbot --nginx -d your-domain.com. Follow the prompts to obtain and install a free Let’s Encrypt certificate.
Access Home Assistant by visiting https://your-domain.com. Complete the initial setup wizard.
Enable automatic updates for the container. Create a script update_homeassistant.sh that pulls the latest image and recreates the container, then add it to cron: crontab -e and add 0 3 * * * /path/to/update_homeassistant.sh.

Common Mistakes

Using --network=host without understanding it: This exposes Home Assistant directly on all interfaces. If you skip the reverse proxy, you must restrict access with firewall rules.
Forgetting to set a strong password during initial setup. Home Assistant’s default authentication is weak; always create a strong password.
Leaving the default HTTP port open. If you don’t set up SSL, your traffic is unencrypted and vulnerable to eavesdropping.
Not updating the container. Home Assistant releases frequent updates; ignoring them can leave known vulnerabilities unpatched.
Using --privileged unnecessarily. It grants extra capabilities that a compromised container could abuse. Use it only if you need USB or specific hardware access.

Tips

Use a dedicated subdomain like ha.yourdomain.com to keep your smart home separate from other services.
Back up your config directory regularly. You can use tar or a Docker volume backup tool.
Enable two-factor authentication (2FA) in Home Assistant for an extra layer of security.
Consider using a VPN (like WireGuard) to access Home Assistant instead of exposing it to the internet, if you only need remote access for yourself.
Monitor resource usage with docker stats to ensure your VPS has enough RAM and CPU.

Troubleshooting

Container won’t start: Check logs with docker logs homeassistant. Common issues include port conflicts (if you’re not using host network) or permission errors on the config directory.
Can’t access the web interface: Ensure the container is running and listening on port 8123. Test with curl http://localhost:8123 on the VPS. If that works, check Nginx and firewall rules.
SSL certificate fails to renew: Certbot usually handles renewal automatically. If it fails, check that port 80 is open and that the domain points to your VPS. Run sudo certbot renew --dry-run to test.
Home Assistant is slow: Check RAM usage. If the VPS is low on memory, consider adding swap space or upgrading the plan.
USB devices not detected: If you need Zigbee or Z-Wave, you must pass the USB device into the container. Add --device=/dev/ttyUSB0 (adjust path) to the Docker run command.

Frequently Asked Questions

Can I run Home Assistant on a free VPS?

Yes, but free tiers often have limited resources. Home Assistant needs at least 1 GB RAM to run smoothly; 2 GB is recommended. Free tiers may also have restrictions on outbound ports, which can affect integrations.

Is it safe to expose Home Assistant to the internet?

It can be safe if you follow security best practices: use a strong password, enable 2FA, keep the system updated, and use SSL. However, limiting access to a VPN is more secure for critical systems.

What is the difference between Home Assistant OS and Docker?

Home Assistant OS is a full operating system with built-in supervisor and add-ons. Docker runs Home Assistant Core in a container, which is lighter but requires manual setup of add-ons and updates.

How do I update Home Assistant in Docker?

Pull the latest image: docker pull ghcr.io/home-assistant/home-assistant:stable, then remove the old container and run a new one with the same parameters. Your config persists in the mounted volume.

Can I use a free domain like DuckDNS?

Yes, DuckDNS is a popular free dynamic DNS service that works well with Home Assistant. You can get a subdomain and use it with Certbot for SSL.

What if I don’t have a domain name?

You can still access Home Assistant via the VPS IP address, but you won’t have a valid SSL certificate. For a secure setup, consider using a free domain or a self-signed certificate (not recommended for production).

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.