Self Hosted Supabase: What the Docker Stack Really Runs

Open docker/docker-compose.yml in the Supabase repository and count the services. On the master branch, on the day we checked, there are eleven. Add the optional logging pair from a separate compose file, and drop the pooler the docs list separately, and you reach the twelve in their list.

That is the first thing to know about self hosted Supabase. It is not one program. It is a Postgres database wearing ten other processes, each written by a different project, and you now own the seams between them.

The self-hosting overview says the same in plainer words. When you host it yourself, you handle server provisioning, security hardening, service management, database maintenance, high availability, backups and monitoring. The rest of this piece goes through those, one at a time.

One correction worth making, because older tutorials get it wrong. Kong used to be the gateway. The current compose file runs Envoy by default and keeps kong as a network alias, so old internal hostnames still resolve. A separate override file brings Kong back if you prefer it.

Notice what the table says about blast radius. Most containers fail alone. Two do not: the database and the gateway. If either goes, the whole product is down, and those are the two to watch first.

With self hosted Supabase you get four jobs, each small on day one and each capable of hurting on day 200.

1. 1SecretsThe setup generates a long list: the Postgres password, publishable and secret API keys, encryption keys for Realtime, the pooler and postgres-meta, the dashboard password, and storage credentials. Losing or leaking any of them is your incident. The docs also note that rotating keys does not invalidate existing session tokens.
2. 2TLSOut of the box the stack answers on plain HTTP. The docs are direct that production needs a valid certificate, and they suggest putting Caddy or Nginx in front of the gateway. That is one more service, and its certificate renewal is yours to monitor. Our guide to custom domains and automatic SSL covers what to check.
3. 3UpgradesStable snapshots arrive roughly monthly, and the images are tested together. Change a single image tag and, in the docs' words, compatibility is not guaranteed. Rolling back a service is a manual tag change, and a database migration inside an upgrade will not roll back with it.
4. 4BackupsThe Docker guide does not describe a backup mechanism. Your data lives in two folders: volumes/db/data for Postgres and volumes/storage for files. Copying a live Postgres data directory is not a backup. Read our guide to Postgres point in time recovery and set up dumps and WAL archiving yourself.

System requirements are modest. The docs give 4GB of RAM and two cores as a minimum, and 8GB and four cores as the recommendation, with a 40GB SSD at the low end. Turn on the optional logging services and you will want the larger figure.

The overview lists what a self hosted Supabase install does without: branching, advanced metrics beyond logs, managed backups and point-in-time recovery, analytics and vector buckets, ETL, and the platform management API. Studio also runs as a single project, with no organisations. Most settings are environment variables rather than dashboard toggles.

That means GitHub Discussions, Discord and Reddit, not a support ticket with a response time. It is a fair arrangement for free software. It is a different thing to plan around when the pager is yours. The docs also point out that Supabase CLI's local stack is for development only and must not be exposed to external traffic. Do not mistake it for a deployment.

Email needs care too. The example configuration points SMTP at a placeholder host. Until you give it a real mail provider, sign-up and password-reset emails will not arrive.

These are failure modes to plan for, drawn from the documented behaviour above. They are not a report of anyone's outage.

• The certificate expires. The reverse proxy you added is renewing quietly until a DNS change or a closed port stops it. The browser shows a warning, and OAuth logins fail first, because providers insist on HTTPS.
• The disk fills. Postgres, Storage files and container logs share one machine. A full disk stops writes, and a stopped Postgres stops all eleven services.
• A pull brings a mismatched image. You changed one tag to get a fix. The docs never promised that combination would work, and auth and the database now disagree about a migration.
• The pooler is on the public internet. Supavisor publishes 5432 and 6543 in the default compose file. If the server has no firewall, that is a Postgres login prompt open to everyone.
• The last backup is not what you think. The nightly job copied a live data directory. It restores to something that does not start.
• A key leaked, and rotating it does not end the sessions already issued from it.

None of these is exotic. Each has a standard fix. The point is that the fix is not in the box. You choose the firewall, the monitor and the backup, and you own them.

If you want a self hosted backend as a service, Supabase is not the only route. Appwrite runs on any system with a Docker CLI, and its docs say self-hosted instances offer the features of Appwrite Cloud, with you managing updates and scaling. Back4app is different: it is a managed platform built on the open-source Parse Server. What you can self host is Parse Server itself, and the dashboard and scaling that Back4app sells do not come with it. Both suit some teams better than Supabase. Neither removes the operating work.

Yes, in three situations, and self hosted Supabase suits all of them. You need the data in a specific place. You already run servers and have a backup routine, so this is one more workload. Or you are learning, and the point is the learning.

No, if the hosted product's bill is what worries you and your team has no one who wants to be on call. The hosted Pro plan starts at $25 a month when checked, which is small next to a broken night. Our comparison of Supabase and Neon sets out what the hosted plans include.

A third route exists, and we should name our interest. Helm7 is a hosting platform that competes with Supabase. It gives you Postgres, GoTrue-compatible auth and Supabase-Storage-compatible buckets on one bill, so supabase-js works against a changed URL and key. It has no equivalent of Realtime. If you depend on Realtime, the hosted product or your own stack is the better answer. The Vercel and Supabase comparison lists where each side wins.