Docker on a Small NAT VPS: Memory, Ports and Persistence

Docker can package applications on a Linux KVM VPS, but containers still share the guest's RAM, CPU and disk allocation. On a small NAT VPS, resource limits, persistent volumes and the two layers of port forwarding need particular attention.

Install for the actual distribution

Follow Docker's current installation instructions for your guest OS and architecture. Do not paste a repository command for a different Debian or Ubuntu release. Review the security implications of Docker access: membership in the Docker group can grant root-equivalent control.

Understand both port layers

An example container may listen on port 80, with Docker publishing it as guest port 8080. The provider's NAT mapping then forwards an assigned public port to guest port 8080. Both layers must match; changing the public port does not change the container's internal listener.

For private-only access, publish to the guest loopback address rather than all interfaces. Review Docker's firewall behavior instead of assuming UFW blocks every published port.

Keep data outside disposable layers

Use named volumes or deliberate bind mounts for persistent data and configuration. Recreating a container does not automatically preserve files written only inside its writable layer. Back up the persistent data consistently, especially databases.

Bound resource and log growth

Set realistic memory and process limits, avoid running unnecessary services and configure log rotation. Image downloads and build caches can consume substantial disk space. Never run cleanup commands until you understand which images, containers and volumes are still needed.

See Compose deployment, memory monitoring and disk checks.

References: Docker installation and Docker firewall behavior.