How to Deploy PocketBase – Open-Source Go Backend Platform

5 min readUpdated 11 September 2026

PocketBase is an open-source backend solution built with Go that bundles a real-time SQLite database, authentication system, file uploads, and administrative dashboard into a single binary. The embedded SQLite engine eliminates external database dependencies, while the built-in REST API and live subscriptions enable rapid development of web and mobile applications.

This article walks through deploying PocketBase on a Linux server with Docker Compose. The setup includes Traefik for automated TLS certificates, pre-configured admin credentials via environment variables, and a practical demonstration of collection creation and API interaction.

Prerequisites

Before you begin, you need to:

Have access to a Linux-based server (with at least 2 CPU cores and 4 GB of RAM) as a non-root user with sudo privileges.
Install Docker and Docker Compose.
Create a DNS A record pointing to your server's IP address (for example, pocketbase.example.com).

Set Up the Directory Structure, Configuration, and Environment Variables

PocketBase persists all data, including the SQLite database, uploaded files, and logs, in a dedicated data directory. Environment variables define the domain configuration, TLS settings, and initial administrator credentials.

Create the project folder and data directory.
CONSOLE
$ mkdir -p ~/pocketbase/pb_data
Powered by Vultr AgentBeta
- pb_data: Stores the SQLite database, uploaded files, and application logs.
Switch to the project folder.
CONSOLE
$ cd ~/pocketbase
Powered by Vultr AgentBeta
Create an environment file to store configuration values.
CONSOLE
$ nano .env
Powered by Vultr AgentBeta
Add the following environment variables:
INI
DOMAIN=pocketbase.example.com LETSENCRYPT_EMAIL=admin@example.com PB_ADMIN_EMAIL=admin@example.com PB_ADMIN_PASSWORD="SecurePassword123"
Powered by Vultr AgentBeta
Replace:
- pocketbase.example.com with your registered domain.
- admin@example.com with your email address for certificate notifications and admin login.
- SecurePassword123 with a strong password. Keep the quotes if using special characters.
Save and close the file.

Deploy with Docker Compose

The deployment stack consists of Traefik for reverse proxy and certificate management, plus the PocketBase container with pre-configured superuser credentials. This configuration uses the community-maintained PocketBase Docker image. On first startup, PocketBase automatically creates the admin account using the provided environment variables.

Create the Docker Compose file.
CONSOLE
$ nano docker-compose.yaml
Powered by Vultr AgentBeta
Add the following manifest:
YAML
services: traefik: image: traefik:v3.6 container_name: traefik command: - "--providers.docker=true" - "--providers.docker.exposedbydefault=false" - "--entrypoints.web.address=:80" - "--entrypoints.websecure.address=:443" - "--entrypoints.web.http.redirections.entrypoint.to=websecure" - "--entrypoints.web.http.redirections.entrypoint.scheme=https" - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true" - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web" - "--certificatesresolvers.letsencrypt.acme.email=${LETSENCRYPT_EMAIL}" - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json" ports: - "80:80" - "443:443" volumes: - "letsencrypt:/letsencrypt" - "/var/run/docker.sock:/var/run/docker.sock:ro" restart: unless-stopped pocketbase: image: ghcr.io/muchobien/pocketbase:0.36.2 container_name: pocketbase environment: - PB_ADMIN_EMAIL=${PB_ADMIN_EMAIL} - PB_ADMIN_PASSWORD=${PB_ADMIN_PASSWORD} expose: - "8090" volumes: - "./pb_data:/pb_data" labels: - "traefik.enable=true" - "traefik.http.routers.pocketbase.rule=Host(`${DOMAIN}`)" - "traefik.http.routers.pocketbase.entrypoints=websecure" - "traefik.http.routers.pocketbase.tls.certresolver=letsencrypt" - "traefik.http.services.pocketbase.loadbalancer.server.port=8090" restart: unless-stopped volumes: letsencrypt:
Powered by Vultr AgentBeta
Save and close the file.
In the above manifest:
- services: Orchestrates two containers through Docker Compose:
  - traefik: Operates as the reverse proxy, handling TLS termination and routing.
  - pocketbase: Runs the backend application with SQLite storage.
- image: Specifies the container image for each service.
- container_name: Assigns fixed names to containers for easier identification in logs and management operations.
- command (Traefik): Configures Docker provider discovery, dual entry points for HTTP/HTTPS, automatic HTTP-to-HTTPS redirection, and Let's Encrypt certificate provisioning via HTTP challenge.
- ports (Traefik): Publishes ports 80 and 443 on the host for external traffic handling.
- environment (PocketBase): Injects superuser credentials from the .env file to auto-create the admin account on first startup.
- expose (PocketBase): Makes port 8090 accessible to other containers (Traefik) without binding it to the host.
- volumes:
  - The letsencrypt named volume stores TLS certificates persistently across container rebuilds.
  - The Docker socket (/var/run/docker.sock) grants Traefik the ability to discover services and update routes dynamically.
  - The pb_data bind mount preserves the SQLite database, uploaded files, and application logs.
- labels (PocketBase): Registers the container with Traefik and defines routing rules for HTTPS traffic based on the domain name.
- restart: unless-stopped: Ensures containers recover automatically after failures or system restarts unless manually stopped.
Warning
The admin account is created only during the first startup when the pb_data directory is empty. If you already have an existing database and want to reinitialize the admin account, remove the data directory before starting the container:
CONSOLE
$ sudo rm -rf ~/pocketbase/pb_data/*
Powered by Vultr AgentBeta
This command permanently deletes all stored data in the pb_data directory.
Launch the containers.
CONSOLE
$ docker compose up -d
Powered by Vultr AgentBeta

Verify both services are operational.

CONSOLE

$ docker compose ps

Output:

NAME         IMAGE                                 COMMAND                  SERVICE      CREATED         STATUS         PORTS
pocketbase   ghcr.io/muchobien/pocketbase:0.36.2   "/usr/local/bin/entr…"   pocketbase   3 seconds ago   Up 3 seconds   8090/tcp
traefik      traefik:v3.6                          "/entrypoint.sh --pr…"   traefik      3 seconds ago   Up 3 seconds   0.0.0.0:80->80/tcp, [::]:80->80/tcp, 0.0.0.0:443->443/tcp, [::]:443->443/tcp

Check the service logs for any errors.
CONSOLE
$ docker compose logs
Powered by Vultr AgentBeta
For more information on managing a Docker Compose stack, see the How To Use Docker Compose article.

Access and Configure PocketBase

The administrative dashboard is accessible at the /_/ path. With superuser credentials configured via environment variables, the initial setup wizard is bypassed and you can log in directly.

Open your web browser and navigate to the PocketBase admin panel at https://pocketbase.example.com/_/, replacing pocketbase.example.com with your domain.
Sign in using the PB_ADMIN_EMAIL and PB_ADMIN_PASSWORD credentials from your .env file.
The dashboard provides access to:
- Collections: Define data schemas with custom fields, validation constraints, and API permission rules.
- Users: Administer registered accounts, verify emails, and manage access controls.
- Logs: Review incoming requests, track errors, and monitor system activity.
- Settings: Configure email delivery, external storage providers, OAuth integrations, and scheduled backups.

Create a Collection and Test the API

Collections represent database tables with auto-generated REST endpoints. PocketBase provides built-in support for CRUD operations, query filters, and result pagination without additional configuration.

From the dashboard sidebar, click + New collection.
Enter tasks as the collection name. Under Fields, click + New field and add:
- Field name: title, Type: Plain text
- Field name: completed, Type: Bool
Switch to the API Rules tab and configure public read access:
- List/Search rule: Leave empty (grants public access).
- View rule: Leave empty.
- Create rule: Set to @request.auth.id != "" (requires authentication).
- Update rule: Set to @request.auth.id != "".
- Delete rule: Set to @request.auth.id != "".
Click Save changes to save the collection.
Add a sample record. Click the tasks collection, then click + New record. Fill in:
- title: Learn PocketBase API
- completed: Unchecked
Click Create to save the record.
Query the collection through the REST API. Replace pocketbase.example.com with your domain:
CONSOLE
$ curl -s https://pocketbase.example.com/api/collections/tasks/records | jq
Powered by Vultr AgentBeta
Output:
{ "items": [ { "collectionId": "pbc_2602490748", "collectionName": "tasks", "completed": false, "created": "2026-02-05 05:06:06.304Z", "id": "z35xnphgqng0bff", "title": "Learn PocketBase API", "updated": "2026-02-05 05:06:06.304Z" } ], "page": 1, "perPage": 30, "totalItems": 1, "totalPages": 1 }
The response contains the task record within the items array.
Test filtering records by adding query parameters:
CONSOLE
$ curl -s "https://pocketbase.example.com/api/collections/tasks/records?filter=(completed=false)" | jq '.items[].title'
Powered by Vultr AgentBeta
Output:
"Learn PocketBase API"
PocketBase supports filtering, sorting, and pagination through query parameters, enabling flexible data retrieval for frontend applications.

Conclusion

You have successfully deployed PocketBase with HTTPS access through Traefik using Docker Compose. The configuration provides a complete backend platform with user authentication, real-time database capabilities, and file storage. PocketBase's admin interface simplifies collection management and user administration, while its REST API enables rapid application development. The SQLite-based architecture simplifies backups by allowing you to copy the pb_data directory. The single-binary design minimizes resource usage for small to medium-scale applications. For more information, refer to the official PocketBase documentation.

Tags:Open Source PocketBase PaaS Developer & DevOps

Set Up the Directory Structure, Configuration, and Environment Variables

Create the project folder and data directory.

CONSOLE

$ mkdir -p ~/pocketbase/pb_data

pb_data: Stores the SQLite database, uploaded files, and application logs.

Switch to the project folder.

CONSOLE

$ cd ~/pocketbase

Create an environment file to store configuration values.

CONSOLE

$ nano .env

Add the following environment variables:

INI
DOMAIN=pocketbase.example.com
LETSENCRYPT_EMAIL=admin@example.com
PB_ADMIN_EMAIL=admin@example.com
PB_ADMIN_PASSWORD="SecurePassword123"
Powered by Vultr AgentBeta

Replace:

pocketbase.example.com with your registered domain.
admin@example.com with your email address for certificate notifications and admin login.
SecurePassword123 with a strong password. Keep the quotes if using special characters.

Save and close the file.

Deploy with Docker Compose

Create the Docker Compose file.

CONSOLE

$ nano docker-compose.yaml

Add the following manifest:

YAML
services:
  traefik:
    image: traefik:v3.6
    container_name: traefik
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.letsencrypt.acme.email=${LETSENCRYPT_EMAIL}"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "letsencrypt:/letsencrypt"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
    restart: unless-stopped

  pocketbase:
    image: ghcr.io/muchobien/pocketbase:0.36.2
    container_name: pocketbase
    environment:
      - PB_ADMIN_EMAIL=${PB_ADMIN_EMAIL}
      - PB_ADMIN_PASSWORD=${PB_ADMIN_PASSWORD}
    expose:
      - "8090"
    volumes:
      - "./pb_data:/pb_data"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.pocketbase.rule=Host(`${DOMAIN}`)"
      - "traefik.http.routers.pocketbase.entrypoints=websecure"
      - "traefik.http.routers.pocketbase.tls.certresolver=letsencrypt"
      - "traefik.http.services.pocketbase.loadbalancer.server.port=8090"
    restart: unless-stopped

volumes:
  letsencrypt:
Powered by Vultr AgentBeta

Save and close the file.

In the above manifest:

services: Orchestrates two containers through Docker Compose:
- traefik: Operates as the reverse proxy, handling TLS termination and routing.
- pocketbase: Runs the backend application with SQLite storage.
image: Specifies the container image for each service.
container_name: Assigns fixed names to containers for easier identification in logs and management operations.
command (Traefik): Configures Docker provider discovery, dual entry points for HTTP/HTTPS, automatic HTTP-to-HTTPS redirection, and Let's Encrypt certificate provisioning via HTTP challenge.
ports (Traefik): Publishes ports 80 and 443 on the host for external traffic handling.
environment (PocketBase): Injects superuser credentials from the .env file to auto-create the admin account on first startup.
expose (PocketBase): Makes port 8090 accessible to other containers (Traefik) without binding it to the host.
volumes:
- The letsencrypt named volume stores TLS certificates persistently across container rebuilds.
- The Docker socket (/var/run/docker.sock) grants Traefik the ability to discover services and update routes dynamically.
- The pb_data bind mount preserves the SQLite database, uploaded files, and application logs.
labels (PocketBase): Registers the container with Traefik and defines routing rules for HTTPS traffic based on the domain name.
restart: unless-stopped: Ensures containers recover automatically after failures or system restarts unless manually stopped.

Warning

The admin account is created only during the first startup when the pb_data directory is empty. If you already have an existing database and want to reinitialize the admin account, remove the data directory before starting the container:

CONSOLE
$ sudo rm -rf ~/pocketbase/pb_data/*
Powered by Vultr AgentBeta

This command permanently deletes all stored data in the pb_data directory.

Launch the containers.

CONSOLE

$ docker compose up -d

Verify both services are operational.

CONSOLE

$ docker compose ps

Output:

NAME         IMAGE                                 COMMAND                  SERVICE      CREATED         STATUS         PORTS
pocketbase   ghcr.io/muchobien/pocketbase:0.36.2   "/usr/local/bin/entr…"   pocketbase   3 seconds ago   Up 3 seconds   8090/tcp
traefik      traefik:v3.6                          "/entrypoint.sh --pr…"   traefik      3 seconds ago   Up 3 seconds   0.0.0.0:80->80/tcp, [::]:80->80/tcp, 0.0.0.0:443->443/tcp, [::]:443->443/tcp

Check the service logs for any errors.

CONSOLE

$ docker compose logs

For more information on managing a Docker Compose stack, see the How To Use Docker Compose article.

Access and Configure PocketBase

The administrative dashboard is accessible at the /_/ path. With superuser credentials configured via environment variables, the initial setup wizard is bypassed and you can log in directly.

Open your web browser and navigate to the PocketBase admin panel at https://pocketbase.example.com/_/, replacing pocketbase.example.com with your domain.

The dashboard provides access to:

Collections: Define data schemas with custom fields, validation constraints, and API permission rules.
Users: Administer registered accounts, verify emails, and manage access controls.
Logs: Review incoming requests, track errors, and monitor system activity.
Settings: Configure email delivery, external storage providers, OAuth integrations, and scheduled backups.

Create a Collection and Test the API

From the dashboard sidebar, click + New collection.

Enter tasks as the collection name. Under Fields, click + New field and add:

Field name: title, Type: Plain text
Field name: completed, Type: Bool

Switch to the API Rules tab and configure public read access:

List/Search rule: Leave empty (grants public access).
View rule: Leave empty.
Create rule: Set to @request.auth.id != "" (requires authentication).
Update rule: Set to @request.auth.id != "".
Delete rule: Set to @request.auth.id != "".

Click Save changes to save the collection.

Add a sample record. Click the tasks collection, then click + New record. Fill in:

title: Learn PocketBase API
completed: Unchecked

Click Create to save the record.

Query the collection through the REST API. Replace pocketbase.example.com with your domain:

CONSOLE

$ curl -s https://pocketbase.example.com/api/collections/tasks/records | jq

Output:

{
  "items": [
    {
      "collectionId": "pbc_2602490748",
      "collectionName": "tasks",
      "completed": false,
      "created": "2026-02-05 05:06:06.304Z",
      "id": "z35xnphgqng0bff",
      "title": "Learn PocketBase API",
      "updated": "2026-02-05 05:06:06.304Z"
    }
  ],
  "page": 1,
  "perPage": 30,
  "totalItems": 1,
  "totalPages": 1
}

The response contains the task record within the items array.

Test filtering records by adding query parameters:

CONSOLE
$ curl -s "https://pocketbase.example.com/api/collections/tasks/records?filter=(completed=false)" | jq '.items[].title'
Powered by Vultr AgentBeta

Output:

"Learn PocketBase API"

PocketBase supports filtering, sorting, and pagination through query parameters, enabling flexible data retrieval for frontend applications.

Conclusion

How to Deploy PocketBase – Open-Source Go Backend Platform

Prerequisites

Set Up the Directory Structure, Configuration, and Environment Variables

Deploy with Docker Compose

Warning

Access and Configure PocketBase

Create a Collection and Test the API

Conclusion

About the Author

Arjun Malhotra

More to Explore

Tech Talk: Running a Self-Improving AI Agent with Hermes on Vultr

Tech Talk: Implementing Fine-Grained Access Control with Vultr IAM

Tech Talk: Getting Started with Vultr IAM

Tech Talk: Simplifying Zero-Trust Networking with NetBird on Vultr Marketplace

0 Comments

How to Deploy PocketBase – Open-Source Go Backend Platform

Prerequisites

Set Up the Directory Structure, Configuration, and Environment Variables

Deploy with Docker Compose

Warning

Access and Configure PocketBase

Create a Collection and Test the API

Conclusion

About the Author

Arjun Malhotra

More to Explore

Tech Talk: Running a Self-Improving AI Agent with Hermes on Vultr

Tech Talk: Implementing Fine-Grained Access Control with Vultr IAM

Tech Talk: Getting Started with Vultr IAM

Tech Talk: Simplifying Zero-Trust Networking with NetBird on Vultr Marketplace

0 Comments