Pangolin VPS requirements: RAM, CPU and disk for a self-hosted tunnel

Sizing guide

Our recommendations, derived from the sourced figures below. Not measurements.

Official requirements

What people report in practice

Individual reports, not controlled tests. Versions, hardware and settings differ, so treat these as data points, not guarantees.

• After 1.13, many 1 GB VPS owners saw the Pangolin container grow until the server hung or OOM-killed. Reported fresh baselines: about 230 MB on 1.11.1, 305 MB on 1.14.1, 296 MB on 1.14, 350 MB on another 1.14 setup. Growth was tied to floods of unauthenticated requests (bots, misconfigured uptime monitors) and to Pangolin's own target health checks

  GitHub issue, Dec 2025 to Jun 2026; a SQLite statement leak fix shipped in 1.18.3, after which a contributor said things improved but small instances still struggled and that adding 1 GB of swap "changed everything"

  GitHub GitHub fosrl/pangolin #2120: Pangolin leaking memory after upgrading to 1.13.1 · checked Oct 26, 2026

• The SQLite fix's author measured the Pangolin container "usually around 335MB" over 48 hours with Uptime Kuma checks and 7-day request retention, on a 1 GB / 2 vCPU AWS t3a.micro

  Pull request merged for 1.18.3, May 2026

  GitHub GitHub fosrl/pangolin PR #2998: finalize SQLite prepared statements · checked Oct 26, 2026

• On 1 vCPU / ~961 MiB with 1 GiB swap, upgrading 1.21.1 to 1.22.2 caused sustained swapping (swap-in rose from ~13–15 to ~163–184 pages/s). On a 2 vCPU / 1.9 GiB box with CrowdSec, OOM kills began two days after 1.22.2; Pangolin was 513–569 MB, Traefik 736–813 MB, CrowdSec 86–96 MB. A restart took Pangolin from 666 to 411 MiB

  GitHub issue, Sep 2026; closed as stale in Oct 2026 without a fix being named. The second reporter added 2 GB swap, a nightly Pangolin restart, and raised 33 health checks from 5 s to 60 s intervals

  GitHub GitHub fosrl/pangolin #3717: Possible 1.22.2 working-set regression on 1 GB VPS · checked Oct 26, 2026

• "I tried on a 1CPU 1GB with Ubuntu Server 24.04 and it sometimes crashed when starting the Docker Stack due to filling the RAM… Switched to 2GB RAM, that is absolutely enough. Sitting at ~1.1 at idle right now" (with CrowdSec and a middleware manager). Others moved to 2 GB after CrowdSec caused crashes, or to load the analytics page; one warned 10 GB of disk gets cramped

  r/PangolinReverseProxy thread, May 2026

  Reddit Reddit r/PangolinReverseProxy: Is this VPS specs enough to run Pangolin? · checked Oct 26, 2026

• A user on RackNerd's cheapest 1 GB tier with CrowdSec and about 10 sites went down about once a day. Replies were split: one runs the same 1 GB RackNerd setup with CrowdSec without a crash, another stopped CrowdSec OOM errors only by moving to 2 cores / 4 GB, and several suggested swap

  r/PangolinReverseProxy thread, Sep 2026

  Reddit Reddit r/PangolinReverseProxy: Is a 1 GB / 1 CPU VPS too small? · checked Oct 26, 2026

• CrowdSec was OOM-killed on a 2 vCPU / 2 GB IONOS VPS after moving every container to :latest. A contributor's fix was pinning the CrowdSec Traefik plugin and setting crowdsecAppsecBodyLimit, and said they run the stack on 1 GB without issues

  GitHub issue, May 2025 (Pangolin 1.3); closed as stale

  GitHub GitHub fosrl/pangolin #694: Out of memory: Killed process (crowdsec) · checked Oct 26, 2026

What drives Pangolin's RAM use

Pangolin is a Node.js app with a database

Most of the RAM goes to the Pangolin container itself, not the tunnel. It starts at a few hundred MB, and the docs list dashboard use, logging and analytics as load. It uses SQLite by default; a PostgreSQL image exists. Reported baselines rose from about 230 MB on 1.11 to about 410 MB on 1.22 (#2120, #3717).

Unauthenticated traffic and health checks

Several investigations found memory grew with denied requests, from bots scanning your domains or uptime monitors hitting Pangolin's login page, and with frequent target health checks. Exempting your monitor with a bypass rule and checking every 60 seconds instead of every 5 helped in the reports.

CrowdSec

The installer can add CrowdSec, which blocks known-bad IPs. Its own process was 86–96 MB in one OOM dump, but it reads logs and caches heavily, and it is the add-on most often named in 1 GB crash reports.

Bandwidth and CPU for throughput

Every request to an app you publish travels from the visitor to the VPS and then down the WireGuard tunnel to your home server, and back. Photo libraries, media streaming and big uploads count against the VPS's monthly transfer allowance, and encryption costs CPU. The docs say most plans include 1–2 TB a month. Check your provider's limit before publishing something like Jellyfin through it.

Gotchas on a VPS

• Add swap on any plan under 4 GB. The docs suggest swap for 1 GB, and users on 1 and 2 GB plans said swap turned OOM kills and hard lockups into slow moments. One used zram (compressed swap in RAM) at 512 MB on a 1 GB VPS (#2120).
• Cap the Pangolin container. A maintainer suggested Docker memory limits so Docker restarts Pangolin instead of the whole VPS locking up. On 1 GB, users found the server could hang before a 400–500 MB limit kicked in, so pair the limit with swap.
• Ubuntu leaves less RAM than Debian. The docs recommend Ubuntu 20.04+ or Debian 11+. On a 1 GB plan, a Reddit reply warned that Ubuntu may leave you "500MB or less" for apps; a minimal Debian image leaves more. That's one user's estimate; we haven't measured it.
• Back up before updating, and pin versions. Release notes ask you to back up the config folder before every update because you can't easily downgrade. Pin image tags instead of :latest, as the CrowdSec OOM thread shows, and watch the Traefik and Badger version notes in each release (releases).
• Leave room on disk. The basic spec is 8 GB, but Docker images grow with updates and the SQLite database grows with request logs and analytics. One 1 GB VPS owner's crashes turned out to be a full 10 GB disk (#2120). Aim for 20 GB or more and set a log retention period.
• Check the firewall and IPv4. You need a public IP and inbound 80/443 TCP plus the WireGuard UDP ports (51820 and 21820 by default). Some providers charge extra for IPv4 or add a cloud firewall that must be opened separately (quick install).

Cheapest plans that fit

Pangolin, official basic spec (no CrowdSec): 2 GB RAM and 1+ vCPU

Threshold: Pangolin docs: 1 vCPU, 2 GB RAM, 8 GB SSD is sufficient for most deployments (source). Only plans with at least 1 vCPU are listed.

Pangolin with CrowdSec, official recommended spec: 2 GB RAM and 2+ vCPU

Threshold: Pangolin docs recommended tier: 2 vCPU, 2 GB RAM, 20 GB SSD; users with CrowdSec report ~1.1 GB idle on 2 GB (source). Only plans with at least 2 vCPUs are listed.

Pangolin for more users or sites: 4 GB RAM and 4+ vCPU

Threshold: Pangolin docs: 4 vCPU, 4 GB RAM, 40 GB SSD for more users or sites (source). Only plans with at least 4 vCPUs are listed.

Plan links marked affiliate link are affiliate links: if you sign up through one, we may earn a commission at no extra cost to you. They go to the provider's site, not to the specific plan; the Source column links the plain pricing page we checked. Affiliate status never changes the order. Disclosure.

Prices checked Oct 21, 2026 on each provider's official pricing page. EUR prices converted at the ECB rate of Oct 20, 2026 (1 € = $1.1215) only for ranking. See all plans on the cheapest 4 GB VPS page.

Related pages

• Jellyfin requirements: Publishing Jellyfin through Pangolin works, but every stream counts against the VPS's bandwidth; check the transfer allowance.
• Immich requirements: A common app to expose through Pangolin; Immich stays at home, so the VPS only carries the traffic.
• Nextcloud requirements: File sync through a tunnel means every upload and download crosses the VPS, so its transfer allowance matters.
• Vaultwarden requirements: A light app to publish through Pangolin; it uses almost no bandwidth, so it suits the smallest VPS.
• Coolify requirements: If your apps already run on a VPS, Coolify's own proxy may be all you need; Pangolin is for apps at home.