how to self-host Dify for VPS with Docker

Wetin Dify be, and wetin you dey sign up to run

Dify na platform wey you fit self-host for to build applications use large language models. You go get web interface for to design chat apps, agents, and retrieval pipelines, API to call dem from your own code, and one place to manage prompts, datasets, and model keys. Na the kind tool small team dey use so everyone fit build on one shared private base, instead of to scatter API keys for different scripts.

To run am yourself means you go run many moving parts. Dify dey come as set of Docker containers: an API server, a background worker, a web frontend, a Postgres database, a Redis cache, and a vector database, all connected together with Docker Compose. E pass single binary, but Compose go handle the connection, and VPS wey get at least a couple gigabytes of RAM go run am well.

Because Dify dey hold your model API keys and, often, private documents wey you upload for retrieval, treat the box wey e dey run on as sensitive from the first minute. This guide go install am, then harden am the way you go harden any service wey dey hold secrets.

Prerequisites

You need VPS wey dey run Ubuntu 24.04 with Docker and the Docker Compose plugin install, and user wey get sudo or membership of the docker group. If Docker na new thing to you, the basics of Docker Compose on a VPS go cover the install and the core commands wey this guide dey assume. Domain name wey point to the server dey good to get, because you go want TLS for front of Dify instead of to use bare IP address.

Step 1: Get Dify and its Compose files

Dify keep its Docker setup for the main repository. Clone am and enter the docker directory:

git clone https://github.com/langgenius/dify.git
cd dify/docker
cp .env.example .env

The .env file na the whole configuration. Read am before you start anything. The values wey matter first na the ones wey set passwords and secrets: SECRET_KEY, the Postgres password, and the Redis password. The example file dey come with placeholder values, and to leave dem as dem dey come na the most common way self-hosted Dify end up compromised. Generate real secret key:

openssl rand -base64 42

Paste that one into SECRET_KEY, and set strong, unique value for every password field for the file.

Step 2: Start it

Bring the stack up:

docker compose up -d

The first run go pull several images and initialize the database, so give am one minute. Check make the containers healthy:

docker compose ps

Every service suppose read running. Dify dey serve its web interface through a bundled nginx container on port 80 by default. When you first visit http://YOUR_SERVER/install, you go create the admin account. Do that immediately, before anything else fit reach the port, because until that account exist, anyone wey load the page fit claim am and own your instance.

Step 3: Do not expose it raw. Put TLS and a firewall in front

Na here most quick installs dey stop and most incidents dey start. Dify's own nginx dey listen on port 80, in the clear, on every interface. You no want say your admin login and your model keys dey travel over plain HTTP, and you no want say internal services dey reachable from outside.

Lock the box down with a default-deny firewall wey go allow only SSH and web traffic:

sudo ufw default deny incoming
sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable

Remember say firewall wey only cover IPv4 fit leave the same ports open on IPv6, the IPv6 firewall gap wey dey catch many self-hosters. Confirm say both stacks dey filtered.

For TLS, the cleanest way na to bind Dify's web port to loopback and run a reverse proxy with a Let's Encrypt certificate for front, so that the only thing for public internet na the proxy wey dey speak HTTPS. Dify's .env go let you change the exposed port; set am to bind on 127.0.0.1 and point your proxy to that one. The agent-hardening ideas for running an AI agent safely on a VPS apply for here too: keep the moving parts on loopback, expose only wetin must be public, and let one hardened front door speak TLS.

Step 4: Keep it patched

Dify dey move fast, and updates dey include security fixes. To update na to pull and restart from the docker directory:

git pull
docker compose pull
docker compose up -d

Read the release notes before you do major version jump, because Dify sometimes dey change the .env schema between releases, and new variable wey you never set fit stop container from start.

Step 5: Back up what you cannot regenerate

Two things for Dify box no fit replace: the Postgres database, wey dey hold your apps, users, and settings, and the volume wey dey store uploaded documents and the vector index. Both dey live under Docker volumes for the docker directory. Take snapshot dem for schedule, and copy the snapshots commot the server. Model API key you fit reissue; the app wey you spend one week build, you no fit replace am.

For more autonomous, code-running agent, see self-hosting Agent Zero, and building your own AI agent on a VPS go cover the foundations for under all of dem.

FAQ

What are the system requirements to self-host Dify?

Dify dey run as a Docker Compose stack of about half a dozen containers, so plan for VPS with at least 2 GB of RAM free, ideally 4 GB, plus a couple CPU cores and enough disk for your uploaded documents and the vector index. The memory pressure dey come from the database and vector store, no be from Dify itself.

Is it safe to expose Dify directly on port 80?

No. Dify's bundled web server dey listen on plain HTTP, and e dey front your admin login and your model API keys. Put a reverse proxy with a Let's Encrypt certificate for front, bind Dify's own port to loopback, and let only the HTTPS proxy face the internet. Pair that with a default-deny firewall wey cover both IPv4 and IPv6.

How do I update a self-hosted Dify?

From the docker directory, run git pull, then docker compose pull and docker compose up -d to fetch new images and restart. Read the release notes first, because Dify sometimes dey add new .env variables between versions, and if one missing, e fit stop container from coming up.

What is the first thing to do after installing Dify?

Visit /install and create the admin account immediately. Until that account exist, anyone wey fit reach the page fit claim am. Set am up the moment the containers healthy, and before you open the firewall to the world.