Best Docker Containers for Your Home Server in 2026

The best Docker containers for a home server in 2026 are Jellyfin for media, Vaultwarden for passwords, Immich for photos, Home Assistant for automation, Pi-hole or AdGuard Home for network-wide ad blocking, Nginx Proxy Manager or Caddy as the reverse proxy, Uptime Kuma for monitoring and Tailscale for remote access. Start with DNS, the proxy and Vaultwarden.

This list is for people running an N100 mini-PC, a Beelink S12 Pro, a Synology that supports Compose, or similar modest hardware. If you have not settled that part yet, the mini PC tiers for a Docker homelab and the NAS models that actually run Docker cover both routes. When you have settled on your shortlist, the interactive compose stack builder turns it into a single ready-to-run docker-compose.yml, and the full topic index collects every per-service walkthrough referenced below.

The 20 best Docker containers in 2026 at a glance

An editorial shortlist, not a performance ranking. Images follow each project’s install docs, with LinuxServer.io builds for Sonarr and qBittorrent; versions are each project’s latest GitHub release on October 8, 2026.

Best Docker containers 2025 vs 2026: what changed

The core picks carry over from 2025. What changed sits underneath, in versions, image tags and one retirement, any of which can break a compose file copied from a 2025 guide:

• Watchtower is gone. The containrrr/watchtower repository was archived on December 17, 2025, and its maintainers would not vouch for any fork. Update deliberately with docker compose pull && docker compose up -d, as Immich’s upgrade docs show, or Dockge’s Update Docker Images action.
• Jellyfin jumped to 12.x. Jellyfin 12.0 shipped on September 7, 2026.
• Immich is on v3. Its machine-learning container on amd64 now needs an x86-64-v2 CPU, per the requirements page.
• Homarr reached v2.0.0 on October 2, 2026. The upgrade migrates the database in place and v1 cannot read it afterwards, so back up /appdata first.

The Foundation Layer: Management and Reverse Proxy

Before any application container, get your management layer sorted.

Dockge (port 5001) is a Docker Compose stack manager from the creator of Uptime Kuma. It’s the right default for anyone who prefers docker-compose.yml but doesn’t want to SSH in every time a restart is needed. Portainer CE is the older, more feature-heavy alternative. It is fine, but its RBAC model and credential management add complexity that a single-node home setup doesn’t benefit from; the Portainer setup guide covers multi-host agents.

For your reverse proxy, Caddy is the answer for most home server operators. Automatic HTTPS via ACME, a simple Caddyfile syntax, and no fighting with certbot renewal timers. Traefik integrates with Docker labels for dynamic per-container routing and is worth learning if you’re managing 20+ services, but the configuration surface is real, as the Traefik with Docker Compose walkthrough makes clear. Caddy first, Traefik when you outgrow it.

For anyone who would rather not edit YAML at all, there is a third option. Nginx Proxy Manager puts a web UI in front of Nginx and handles Let’s Encrypt certificates from a form, reaching the same outcome as Traefik with no configuration files:

services:
  npm:
    image: jc21/nginx-proxy-manager:latest
    container_name: nginx-proxy-manager
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "81:81"  # web UI
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt

Port 81 is the admin interface, and it should never be exposed beyond your LAN. The Nginx Proxy Manager tutorial covers proxy hosts and wildcard certificates.

Media Stack: Jellyfin and the *arr Ecosystem

Jellyfin is the default media server recommendation in 2026. Completely open-source, no account required, no telemetry, and the LinuxServer.io image handles PUID/PGID permission mapping correctly out of the box. For hardware transcoding on Intel N-series mini-PCs, mount /dev/dri:/dev/dri, and Quick Sync handles 4K HEVC transcoding without pegging the CPU at all.

A minimal starting point, with the render device mounted for Quick Sync; the Jellyfin Docker Compose setup covers ports, permissions, and discovery:

services:
  jellyfin:
    image: jellyfin/jellyfin:latest
    container_name: jellyfin
    restart: unless-stopped
    environment:
      - JELLYFIN_PublishedServerUrl=https://media.yourdomain.com
    volumes:
      - ./config:/config
      - ./cache:/cache
      - /mnt/media:/media:ro   # your media library, read-only
    devices:
      - /dev/dri:/dev/dri      # Intel/AMD GPU transcoding

Plex remains valid if you want its polished apps and accept the account requirement.

Build the *arr automation stack around Jellyfin if you want downloads managed without manual intervention:

• Sonarr: TV show management and download automation
• Radarr: the same for movies
• Prowlarr: indexer manager that feeds both
• Bazarr: automatic subtitle downloads
• Jellyseerr: a request interface for family members so they stop texting you to add things

Budget a Saturday afternoon for it.

The *arr apps need a download client underneath them, and qBittorrent is the usual pick, a web-accessible client that Sonarr and Radarr drive directly.

Set PUID and PGID to the same values across qBittorrent and the *arr containers, so every service in the pipeline reads and writes the downloads directory as the same user.

Privacy and Networking

Pi-hole or AdGuard Home provides DNS-level ad blocking for every device on the network without per-client setup. AdGuard Home has a cleaner UI and supports DNS-over-HTTPS natively; Pi-hole has a larger community and more documentation covering edge cases. Either runs comfortably on an N100, and either is a five-minute install. One deployment decision is worth making before you paste the compose file: a DNS container that borrows the host’s address collides with anything already bound to port 53 on that machine, which is why many homelabs hand it its own LAN IP through a macvlan network instead of publishing ports.

services:
  pihole:
    image: pihole/pihole:latest
    container_name: pihole
    restart: unless-stopped
    environment:
      - FTLCONF_webserver_api_password=changethis
      - FTLCONF_dns_listeningMode=ALL
      - TZ=Etc/UTC
    volumes:
      - ./etc-pihole:/etc/pihole
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "8080:80"
    cap_add:
      - NET_ADMIN

Note the web UI is mapped to 8080 rather than 80, leaving port 80 free for whichever reverse proxy you settled on above. Keep FTLCONF_dns_listeningMode=ALL, the value in the official compose example, on a bridge network: Pi-hole v6 otherwise answers only local queries and drops the ones from LAN clients, so it starts but filters nothing. The Pi-hole Docker Compose guide covers that setting and freeing port 53.

Vaultwarden is a Bitwarden-compatible password server; the deployment guide covers HTTPS, closed signups, and backups for official Bitwarden clients.

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    volumes:
      - ./data:/data
    environment:
      - DOMAIN=https://vault.yourdomain.com
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.vw.rule=Host(`vault.yourdomain.com`)"
      - "traefik.http.routers.vw.entrypoints=websecure"
      - "traefik.http.routers.vw.tls.certresolver=letsencrypt"

Older guides still set WEBSOCKET_ENABLED=true; Vaultwarden has ignored it since v1.29.0, and its Compose examples mark DOMAIN as required behind a reverse proxy.

Stand the reverse proxy up before Vaultwarden rather than after: the browser extension requires HTTPS to talk to the server at all, so a plain HTTP deployment looks broken even though it is running fine. Self-hosting keeps credentials off third-party servers; for the wider breach picture, TechSentinel.news covers security incidents.

Tailscale solves remote access without port forwarding. Install the container (or the agent directly on the host), authenticate once, and every device on your Tailnet reaches your home server through an encrypted WireGuard tunnel. The free Personal plan covers up to 6 users with unlimited user devices. For most home lab operators, this is the whole remote-access answer.

Self-Hosted Cloud

Nextcloud is mature, feature-rich, and genuinely complex to operate well. The official Docker image works, but plan for PostgreSQL and Redis from day one, because SQLite collapses under any meaningful write load. The All-in-One container simplifies setup at the cost of configurability.

Immich manages photos with mobile backup and local search. Its requirements specify at least 6 GB RAM, with 8 GB recommended; a 4 GB deployment needs machine learning disabled.

Paperless-ngx handles scanned documents with OCR. Scan receipts and invoices into it and search them by content years later.

Syncthing is for people who want none of the above: decentralised file sync with no server role, where the home server and your laptop sync directly. If all you wanted was Dropbox-style sync, it replaces Nextcloud at a fraction of the operational weight.

Home Automation

Home Assistant is the de facto standard, supporting thousands of integrations across smart lights, thermostats, sensors and presence detection, with a large community and unusually good documentation.

services:
  homeassistant:
    image: ghcr.io/home-assistant/home-assistant:stable
    container_name: homeassistant
    restart: unless-stopped
    privileged: true
    network_mode: host    # required for device discovery
    volumes:
      - ./config:/config
      - /etc/localtime:/etc/localtime:ro

That network_mode: host line is not optional if you want local device discovery to work, and it has a consequence worth planning around: a host-networked container does not play well with Traefik or any other label-driven reverse proxy. Reach Home Assistant directly on its own port, 8123 by default, and route the rest of your stack normally. What that line turns off, and the two alternatives to it, are set out in the Docker Compose host networking guide.

Local AI

Ollama + OpenWebUI pairs a local model server with a browser chat interface. Treat model size, memory, and GPU requirements as a separate hardware decision before adding it to an otherwise lightweight stack.

Queries stay on-device. For threat modeling around self-hosted inference, aisec.blog covers prompt security and model access patterns.

Backup and Monitoring

Uptime Kuma monitors your services and sends alerts through Slack, Telegram, email, or webhooks the moment something falls over. Five minutes to configure, and it covers HTTP, TCP, DNS and ping checks:

services:
  uptime-kuma:
    image: louislam/uptime-kuma:2
    container_name: uptime-kuma
    restart: unless-stopped
    volumes:
      - ./data:/app/data
    ports:
      - "3001:3001"

Grafana + Prometheus is the step beyond that, and a much larger one. Prometheus scrapes metrics from your services and infrastructure while Grafana turns them into dashboards. The setup effort is high, so it belongs late rather than early. Start from a community stack such as dockprom, which bundles Prometheus, Grafana, cAdvisor for container metrics and Node Exporter for host metrics into one Compose file, rather than assembling four services yourself.

Kopia handles encrypted incremental backups with deduplication. Point it at a NAS dataset, a Samba share, or a Backblaze B2 bucket and schedule daily snapshots. Duplicati is the older alternative.

One standing rule: test your restore before you need it. Backups you have never restored from are assumptions.

Small Wins Worth Ten Minutes Each

These are low-effort, high-satisfaction additions once the foundation is in place:

• Homarr, Homer or Dashdot: a homepage for your own services, so the URLs live somewhere other than your memory. Homer is the most widely used; Homarr has a more modern UI and reads the Docker socket to discover what you are running.

services:
  homarr:
    image: ghcr.io/homarr-labs/homarr:latest
    container_name: homarr
    restart: unless-stopped
    environment:
      - SECRET_ENCRYPTION_KEY=replace-with-64-hex-chars   # openssl rand -hex 32
    volumes:
      - ./homarr/appdata:/appdata
      - /var/run/docker.sock:/var/run/docker.sock:ro
    ports:
      - "7575:7575"

This is the current image from homarr-labs, now on the v2 line (2.3.0 on October 8, 2026). The older ghcr.io/ajnart/homarr image is the archived 0.x release and gets no further updates, so do not start a new install on it. Keep the SECRET_ENCRYPTION_KEY with your backups, since Homarr uses it to encrypt stored secrets.

Mount the Docker socket read-only, as above, whenever a container asks for it. Homarr only needs to look.

What to Run First

If this is a first home server, the order matters more than the list does:

1. Pi-hole or AdGuard Home: network-wide benefit on day one, and simple enough to build confidence.
2. A reverse proxy plus Vaultwarden: this pairing teaches you the routing and certificate model you will use for everything else, and leaves you with a password manager at the end of it.
3. Uptime Kuma: so you learn a service has fallen over from an alert rather than from someone complaining.

Add Jellyfin and Home Assistant once those feel routine. Leave Grafana and Prometheus until you have enough services running to give the dashboards something to say, and leave local AI until you have checked your RAM against the hardware notes below. Each of those steps has a full walkthrough in every homelab guide on this site, and if Compose itself is new, start with the first self-hosted stack walkthrough.

Which Docker images to pull in 2026

Pull the image named in the project’s own install docs, pin a major-version tag where one exists, and use LinuxServer.io builds for the *arr apps and download clients. That rule produced every image in the table above and keeps you off abandoned ones such as containrrr/watchtower.

A Docker Official Image badge, which caddy carries, is not a verdict on fit: the official nextcloud image calls itself “maintained by community volunteers and designed for expert use” and points newcomers to Nextcloud All-in-One. LinuxServer.io images map the container’s user to yours through PUID and PGID, so new files are not owned by root.

Tags are mutable, so :latest can change under you; Docker’s build guidance says pinning to a digest guarantees the same image every time. Major-version tags such as louislam/uptime-kuma:2 and portainer/portainer-ce:lts, both from the projects’ own docs, are the practical middle ground.

Hardware Notes

Most containers on this list are lightweight, at 50-500MB RAM each in steady state. The exceptions:

• Jellyfin transcoding: high CPU without hardware acceleration; mount /dev/dri and the load drops dramatically
• Nextcloud with PostgreSQL + Redis: budget around 2GB total for the stack
• Immich: at least 6GB RAM, 8GB recommended; 4GB requires disabling machine learning
• Ollama with any real LLM: 8-16GB RAM minimum, GPU strongly recommended

An N100 mini-PC with 16GB RAM handles the full stack minus local AI. Bump to 32GB and you can run Ollama with smaller models (7-8B parameters) comfortably. To turn that list into a number before you buy, the container resource calculator estimates total RAM and cores for a stack, and the three mini PC tiers compared match the total to a box.

Add a NAS for media and backup storage. Do not put your media library on the same NVMe as your OS and databases. The best NAS for Docker containers guide covers which NAS platforms genuinely run Compose.

If you expose anything beyond Tailscale, the homelab firewall guide at firewallcompare.com covers the layer between this box and the internet.

Related across the network

• Home Assistant OS vs Container: Which Install Method to Pick — homeassistanthq.com
• Install Open WebUI With Docker: Setup Guide — openwebuihq.com

FAQ

how many docker containers can a home server run

RAM, not a container limit, decides it. Most containers here idle at 50 to 500 MB, so a 16 GB N100 mini-PC runs everything in the table except local AI. Immich alone needs 6 GB minimum, and Ollama with a real model wants 8 to 16 GB.

do i need a reverse proxy for home server containers

Not for LAN-only use: each web UI answers on its own port, such as 8096 for Jellyfin or 3001 for Uptime Kuma. You want one for HTTPS and friendly hostnames. Vaultwarden is the exception, because its web vault requires HTTPS and a secure context for the Web Crypto API.

is dockge or portainer better for a home server

Dockge, for a single host. It manages plain compose.yaml files on disk, updates images and runs on port 5001. Portainer CE, at 2.45.2 LTS in October 2026 with its UI on port 9443, earns its heavier interface when you need Edge agents or manage containers outside Compose. Dockge 1.4.0 added multi-host agents too.