My Self-Hosting Setup in 2026: What I Actually Run on an Oracle ARM Box
A real tour of the self-hosted services on my Oracle Cloud Always Free ARM instance — Penpot, Portainer, Nginx Proxy Manager, Homepage, and more. With real Docker Compose snippets and a $0 monthly ...
- Self-Hosting
- DevOps
- Docker
- Oracle
- Cloud
Key Takeaways
- Everything runs on a single 4-OCPU ARM Neoverse-N1 instance with 16GB RAM — entirely free on Oracle’s Always Free Tier
- My stack includes: Penpot (Figma alternative), Portainer, Nginx Proxy Manager, Homepage dashboard, Stirling PDF, and this very blog — all behind Tailscale for private access — this isn’t a theoretical wishlist, it’s what’s actually running right now
- Total monthly cost: $0
Why I Started Self-Hosting
It started with a simple frustration: I was paying for SaaS tools I could run myself, and I wanted to try self-hosting and managing them myself instead. In early 2025, I signed up for an Oracle Cloud Always Free account.
The offer is the most generous there is: 4 OCPUs (ARM Ampere A1), 16 GB of RAM, 200 GB of block storage, and 10 TB of outbound data transfer per month — all completely free. The only catch is Oracle reclaims idle instances, so you need to actually use your machine.
I spun up Ubuntu 24.04 LTS, installed Docker, and started playing with services one by one.
What follows is a tour of what I’m actually running.
The Foundation: Docker + Tailscale
I manage everything with Docker Compose. No Kubernetes, no Nomad, no Coolify — just Docker and a single docker-compose.yml per service.
I route everything through Nginx Proxy Manager for reverse proxying and SSL, and everything is accessible only via Tailscale (a mesh VPN) — no public ports exposed except those I explicitly open.
Why Tailscale Instead of Cloudflare Tunnel?
I tried Cloudflare Tunnel. It’s great for public-facing services, but for personal tools I want zero dependence on a third-party proxy. Tailscale gives me:
- WireGuard-based mesh VPN with zero config
- MagicDNS so I can use
http://service-name.tailnet-name.ts.net/from any device - ACLs to control who can access what
- No open ports on the public internet
My Tailscale network has 5 devices: this server, my MacBook Air, my Mac Mini, my phone, and my Windows laptop. I can reach any service from any device.
Service 1: Penpot — The Open-Source Figma
Penpot is how I do my designs. It’s an open-source design and prototyping tool that’s been gaining serious traction — 55,000+ GitHub stars as of July 2026.
I use it for UI mockups, wireframes, and even slides and illustration work.
Why Penpot over Figma?
Figma is $16/mo per seat. Penpot is free. For a solo developer who needs basic UI design, Penpot is more than capable.
It’s about 5 containers, but they’re lightweight — the whole stack uses about 1.2GB of RAM idle.
Service 2: Portainer — Docker Management UI
Managing Docker entirely from the command line gets old. Portainer gives me a web UI for container management, logs, stats, and terminal access.
It’s my go-to for quick container restarts and log inspection.
Real Usage
In the 4 weeks since I started this instance, Portainer has saved me hours of docker logs and docker exec commands.
The built-in container stats view is particularly useful — I can see at a glance that Penpot is using 1.2GB, Nginx Proxy Manager is using 80MB, and my total Docker memory usage hovers around 2.5GB.
Service 3: Nginx Proxy Manager
This is the traffic cop for my stack. Nginx Proxy Manager handles reverse proxying and SSL certificate management through a clean web UI.
The admin panel is on port 81, accessible only via Tailscale.
Service 4: Homepage — The Dashboard
Homepage (gethomepage.com) is a beautiful, customizable dashboard that shows all my services, system stats, and bookmarks in one place.
It auto-detects Docker containers and shows their status, plus I’ve added widgets for system resources (CPU, RAM, disk, uptime). It’s my browser’s homepage — literally.
Service 5: Stirling PDF
Stirling PDF is a Swiss Army knife for PDFs — merge, split, convert, compress, OCR, you name it. It runs entirely in the browser, no data leaves the server. No need to pay for Adobe PDF anymore!
I use it mostly for:
- Merging scanned documents into single PDFs
- Converting images to PDF
- Compressing large PDFs for email
- OCR on scanned documents
Service 6: Hermes Agent (The AI That Ochestrates Everything)
Hermes Agent runs as a systemd service and connects to Telegram, so I can talk to it from my phone.
It uses models from OpenRouter. The overhead is minimal — about 500MB of RAM idle, and it only spikes CPU during actual generation tasks.
With an on instance AI agent, it can manage everything for me without me even having to SSH in or do any configuration!
The Numbers: Real Resource Usage
I ran docker stats and htop while writing this. Here’s what the machine actually looks like:
| Metric | Value |
|---|---|
| CPU | 4 OCPU (ARM Neoverse-N1) |
| RAM | 16 GB total, ~4.1 GB used |
| Disk | 45 GB total, 37 GB used (83%) |
| Docker containers | 15 running |
| Docker networks | 6 |
| Docker volumes | 4 |
| Uptime | 93 days |
| Load average | 0.07 / 0.14 / 0.09 |
The machine is mostly idle. Even with 15 containers running, the CPU load is negligible. The 4.1GB of RAM usage includes the OS, Docker, Postgres, and all services — leaving 11GB free for burst workloads.
What I Don’t Run (and Why)
I want to be honest about what’s not in my stack:
- Vaultwarden — I use Apple’s built-in password manager. It’s good enough and syncs across all my devices natively.
- Jellyfin — I don’t have a media library to serve. I stream from Spotify and Netflix like everyone else.
- Nextcloud — I use iCloud for file sync. The friction of maintaining a Nextcloud instance isn’t worth it for me.
- Uptime Kuma — Hermes Agent handles monitoring via cron jobs. If a service goes down, I get a Telegram alert.
The self-hosting community loves to recommend all of these, but the truth is: run what you actually need, not what looks cool on a GitHub README.
What It Costs (Real Numbers)
The only ongoing cost I have is the API calls to OpenRouter for the AI agent, about $5/month for the work it does.
Lessons Learned After 93 Days of Uptime
- Start small. Don’t spin up 15 containers on day one. Add services one at a time as you need them.
- Use Tailscale. It’s the single best networking decision I made. No port forwarding, no firewall rules, no dynamic DNS.
- Back up your Docker volumes. I use BorgBackup to a Backblaze B2 bucket. Restoring from scratch would take an afternoon.
- Monitor disk space. 45GB fills up fast. Docker images, logs, and database dumps are the main culprits. I have a cron job that prunes old images weekly.
- Oracle will reclaim idle instances. Keep CPU above 20% average. My Hermes cron jobs and the blog portal generate enough traffic to keep it active.
- ARM compatibility is rarely an issue anymore. Almost every major Docker image has ARM64 builds. The only exceptions I’ve hit are some niche tools — and even those are getting rarer.
- Don’t over-engineer. I don’t use Kubernetes, Ansible, or Terraform for a single-machine setup. Docker Compose + a bash script for backups is all you need.
The Bottom Line
Self-hosting in 2026 is easier and cheaper than ever. Oracle’s Always Free Tier gives you a genuinely capable machine for $0. Docker Compose is all you need to manage services. Tailscale makes networking a non-issue. And the community has matured to the point where most tools are production-ready, not just hobby projects.
I’m running 15 containers, serving a blog, generating TikTok videos, running AI agents, and managing all my personal tools — all on a free ARM instance that’s been running for 93 days straight.
The best time to start self-hosting was five years ago. The second best time is today.
All services mentioned are ones I actually run on my own Oracle Cloud instance. Hardware specs, Docker configurations, and cost breakdowns are based on real usage data from my machine.