Forgejo VPS requirements: RAM, CPU, disk, and what actually breaks it

Sizing guide

Our recommendations, derived from the sourced figures below. Not measurements.

Official requirements

What people report in practice

Individual reports, not controlled tests. Versions, hardware and settings differ, so treat these as data points, not guarantees.

• Forgejo 15.0.10 with PostgreSQL 17 and an idle runner averaged 285.7 MiB (peak 300.1 MiB) and under 1% of one CPU core: about 204 MiB for Forgejo, 73 MiB for Postgres and 8 MiB for the runner. Forgejo 17.0.0 idled at 315.3 MiB on the same host. Images were 188 MB (Forgejo), 297 MB (Postgres) and 46 MB (runner) unpacked, and the stack answered its health check 5.4 seconds after start

  Comparison test against GitLab CE on an 8 vCPU host, 19 Oct 2026. Idle averages from docker stats after a pipeline, a registry push, a migration and a backup

  Blog DEV Community (deploylark): GitLab CE vs Forgejo, self-hosted Git on Docker, measured · checked Oct 29, 2026

• Peak RAM during YunoHost's package test was 231 MB for Forgejo, against 372 MB for Gitea, with 146 MB still in use after the test. The thread started because the Forgejo package asked for 2 GB and the Gitea package for 100 MB

  YunoHost forum, Jan 2025, quoting the packaging CI job. A short automated install test, not a production instance

  Forum YunoHost forum: RAM usage for Gitea and Forgejo · checked Oct 29, 2026

• On a 2 GB server, Forgejo reached 1.1 GB resident (55% of RAM) and the machine was swapping, with requests taking up to 490 seconds, after "bots were hitting very hard on /issues?assignee and /pulls?assignee the whole night". In the same thread, a user who saw 8.4 GiB in docker stats got a diagnosis report showing 77.8 MB of Forgejo heap, and a maintainer said there's no leak; the rest was likely page cache

  Codeberg issue thread, Mar to May 2026, Forgejo 14.0.3 and a PostgreSQL install with the twoqueue cache

  Codeberg Codeberg forgejo #11847: Instance Memory Leak · checked Oct 29, 2026

• Bots found the auto-generated source archive links and downloaded them at up to 100 Mb/s. "Once hundreds of gigabytes of archives consumed all disk space, memory usage also spiked", and most services on the server went offline. robots.txt didn't stop them; a proof-of-work and challenge proxy (go-away) did

  Personal blog of a Forgejo admin, May 2025

  Blog Jade Ellis: Actually stopping AI scrapers from taking down my server · checked Oct 29, 2026

• A small personal Forgejo on a VPS, used for projects like Advent of Code solutions, received about 600,000 crawler requests a day (about 10 per second): every file at every commit, blame views, archives and every issue and pull request filter combination. Anubis cut most of it, and a cookie check in Caddy that lets git, git-lfs and runner traffic through did the rest

  Personal blog, Dec 2025

  Blog Honeypot.net: How I protect my Forgejo from AI crawlers · checked Oct 29, 2026

• Forgejo 7.0.4 and 7.0.5 sometimes climbed to 14–17 GB of RAM and all 8 cores until the admin killed it. A maintainer traced the heap profile to the syntax highlighter (Chroma) rendering a diff; another commenter pointed to scrapers requesting expensive diffs. The reporter found 8.0 fixed it for them

  Codeberg issue, July to Aug 2024, on an 8-core VPS. An old version, but it shows what one expensive page can do without a memory limit

  Codeberg Codeberg forgejo #4428: Randomly Forgejo begins using a lot of RAM and CPU · checked Oct 29, 2026

What drives Forgejo's RAM use

A small Go binary, then whatever the requests cost

An idle Forgejo sits around 200 MiB, and a diagnosis report from a running instance showed under 80 MB of Go heap (#11847). Memory goes up with work: rendering large diffs with syntax highlighting, blame views, search and big clones. One expensive diff took a 7.0.x instance to 14–17 GB (#4428). Normal use by a few people never gets near that.

Crawlers multiply the expensive pages

A forge exposes every file at every commit, every blame and every filter combination as its own URL. Scrapers that walk them all turn a personal server with a handful of real visitors into one serving about 600,000 requests a day (Honeypot.net). That is what pushed one 2 GB server into swap (#11847). A private instance doesn't have this problem.

Disk: repositories, LFS, packages, archives and the indexer

Everything users push lands on the server's disk: repositories, LFS objects, the package registry and Actions logs and artifacts. Two settings can grow it quickly. The code indexer uses about six times the repository size (cheat sheet), and source archives are generated on request and kept for up to a day, which is how crawlers filled one server's disk with hundreds of gigabytes (Jade Ellis). The container image itself is about 188 MB unpacked (deploylark).

CI is a separate workload

Forgejo only queues Actions jobs. The runner runs them, usually in containers, and a build can need far more RAM and CPU than the forge. The runner idled at about 8 MiB in one test (deploylark); the jobs are what you size for.

Gotchas on a VPS

• Keep public instances behind a bot filter. robots.txt helps with search engines, but admins report scrapers ignoring it (Jade Ellis). What worked for them was a challenge proxy such as Anubis or go-away in front of Forgejo, letting git, git-lfs and runner traffic through (Honeypot.net). If the forge is just for you, keep it private: set REQUIRE_SIGNIN_VIEW or reach it over a VPN or tunnel such as Pangolin, Tailscale or WireGuard.
• Turn off source archives you don't need. Each download-as-zip creates an archive on disk that stays until the nightly cleanup (cheat sheet). Set DISABLE_DOWNLOAD_SOURCE_ARCHIVES = true, or at least add Disallow: /*/*/archive/ to robots.txt as the docs suggest (docs).
• Close registration. Registration is open by default (DISABLE_REGISTRATION = false). With Actions enabled, an unknown account that can create a repository can try to run workflows on your runner, which the security guide treats as remote code execution (docs). Set DISABLE_REGISTRATION = true and create accounts as the admin.
• Ports 3000 and 222 are public by default. The example compose file publishes 3000:3000 and 222:22 on every interface (docs), and Docker's port rules bypass UFW. Bind the web port to 127.0.0.1 behind a reverse proxy with HTTPS, and leave the VPS's own SSH on port 22 so Git over SSH and admin logins don't collide.
• Pick the release line on purpose. There's no latest tag, and a major upgrade needs a manual check. 15.0 LTS is supported until July 2027, and 16.0 reaches end of life on 29 October 2026 (release schedule). The 17.0.0 release page still warns against upgrading because of a push and merge issue (release). On a server you don't want to babysit, pin the 15 tag.
• Use the small-instance cache setting. The docs suggest [cache] ADAPTER = twoqueue with a 100-item limit for quiet instances, because the default can hold 50,000 items for 16 hours (docs). Set a container memory limit too, so a runaway request restarts Forgejo instead of freezing the VPS.
• Check memory with docker stats or the admin dashboard. Some dashboards count page cache as container memory. In one report a tool showed 8.4 GiB while Forgejo's own diagnosis found 77.8 MB of heap (#11847). Use docker stats --no-stream or Site Administration's system status before resizing the server.

Cheapest plans that fit

Forgejo, private, SQLite, no CI on the box: 1 GB RAM and 1+ vCPU

Threshold: No official figure. Tests reported about 150–320 MiB for Forgejo, and 1 GB leaves room for the OS, a proxy and large clones (source). Only plans with at least 1 vCPU are listed.

Forgejo with PostgreSQL or open to the internet: 2 GB RAM and 1+ vCPU

Threshold: No official figure. A public 2 GB server swapped with Forgejo at 1.1 GB under bot traffic, so 2 GB is a floor that still needs a bot filter (source). Only plans with at least 1 vCPU are listed.

Forgejo plus an Actions runner on the same VPS: 4 GB RAM and 2+ vCPU

Threshold: Our estimate, not a measurement: Forgejo's few hundred MiB plus room for typical container builds. Size up for heavy builds (source). Only plans with at least 2 vCPUs are listed.

Prices checked Oct 28, 2026 on each provider's official pricing page. EUR prices converted at the ECB rate of Oct 27, 2026 (1 € = $1.115) only for ranking. See all plans on the cheapest 4 GB VPS page.

Related pages

• Coolify requirements: Coolify can deploy from a Git source on push; a self-hosted forge plus Coolify is a small private alternative to GitHub plus a PaaS.
• Uptime Kuma requirements: Run Uptime Kuma on a different small VPS to watch your forge's web UI and certificate from outside.
• Pangolin requirements: Keep a private Forgejo off the public internet and reach it through a Pangolin tunnel instead.
• n8n requirements: Forgejo webhooks can trigger n8n workflows on pushes, issues and pull requests.
• Vaultwarden requirements: Another light, single-container app that fits next to Forgejo on a 1–2 GB VPS.