Pi-hole VPS requirements: RAM, CPU, disk, and how not to run an open resolver

Sizing guide

Our recommendations, derived from the sourced figures below. Not measurements.

Official requirements

What people report in practice

Individual reports, not controlled tests. Versions, hardware and settings differ, so treat these as data points, not guarantees.

• After upgrading from v5 to v6, pihole-FTL memory went from about 70 MB to a peak of 150 MB over a month of use, with CPU spikes only during updates

  r/pihole, March 2025, Debian unprivileged LXC container

  Reddit r/pihole: Pihole 5 vs Pihole 6 memory and CPU usage · checked Oct 30, 2026

• pihole-FTL showed 159.5 MB resident (36.6% of the machine's RAM) with high sustained CPU on early v6. The lead FTL developer said more RAM is expected in v6 because of an in-memory database behind the server-side query log, and that a test VM with 256 MB hit an out-of-memory kill during a blocklist update. A user with about 2 million blocklisted domains had run v5 in 128 MB for years and needed 256–300 MB on v6; the developer's reply: "256 MB of RAM may just be too little in modern times"

  GitHub issue, Feb to Mar 2025, FTL v6.0 to v6.0.5. FTL v6.0.4 fixed the sustained CPU load for several reporters

  GitHub GitHub pi-hole/FTL #2194: V6 high sustained CPU and memory load · checked Oct 30, 2026

• Pi-hole v6 took just over 4 minutes to start because pihole-FTL.db had grown to 6.8 GB with over 100 million rows. Deleting everything older than 30 days and running VACUUM shrank it to about 270 MB and DNS came back right after reboot. In the same thread, members said 1 GB of RAM or more is better for processing large blocklists

  Pi-hole Discourse, Feb 2025, VMs with 4 GB RAM and 2 cores, upgraded from a long-running v5 install

  Forum Pi-hole Discourse: Pihole 6 slow start-up with large gravity lists · checked Oct 30, 2026

• On a 512 MB Raspberry Pi Zero 2 W with about 28 clients and small blocklists (gravity.db 7.8 MB), pihole-FTL used about 130 MB, swap was around 140 MB and the dashboard took 5–10 seconds to load. Another user fixed a slow v6 on a Pi 3 by shrinking the FTL database

  Pi-hole Discourse, 2025, Pi-hole also acting as a Tailscale subnet router. Shows that 512 MB is tight once the OS and other services share it

  Forum Pi-hole Discourse: High query latency and slow dashboard on Pi Zero · checked Oct 30, 2026

• Expected about 200 MB of RAM but pihole-FTL took 2 GB plus 1.5 GB of swap after the v6 update and stopped answering DNS. The cause turned out to be a wrong system clock on the host; fixing the time fixed it

  Pi-hole Discourse, Feb 2025

  Forum Pi-hole Discourse: Pi-hole stopped working after v6 update · checked Oct 30, 2026

• A user who exposed Pi-hole on a cloud VPS got a notice from their country's cybersecurity agency within about two days. Others in the thread run Pi-hole with WireGuard, OpenVPN or Tailscale on the VPS and allow ports 53, 80 and 443 only from the tunnel interface

  r/pihole, May 2022, thread titled "PiHole on small cloud VPS, how safe is it"

  Reddit r/pihole: PiHole on small cloud VPS, how safe is it · checked Oct 30, 2026

What drives Pi-hole's RAM use

Blocklists (gravity) are the main memory cost

Every domain on your lists ends up in Pi-hole's gravity database, and an update rebuilds it. The memory use grows with the size of the lists: a user with about 2 million domains had to raise a container from 256 MB to 300 MB to let an update finish, and the lead developer hit an out-of-memory kill on a 256 MB test VM (FTL #2194). The default list is far smaller. More lists rarely block much more, so trimming them is cheaper than a bigger server.

v6 keeps a day of queries in memory

Version 6 moved the query log to the server and keeps an in-memory database so it stays fast, which roughly doubled memory compared with v5 for some users, from about 70 MB to 150 MB (Reddit). The API loads up to 24 hours of history by default; lowering webserver.api.maxHistory shrinks it (config docs). A handful of personal devices makes a small history.

Disk: the query database grows for 91 days

Queries are stored for 91 days by default (config docs). On a busy network that adds up: one long-running install reached a 6.8 GB database that made v6 take over four minutes to start (Discourse). A few personal devices behind WireGuard produce far less, and lowering database.maxDBdays caps it.

CPU barely matters

The docs say Pi-hole does not need much processing power (prerequisites), and it runs on a Raspberry Pi Zero. CPU spikes come from blocklist updates and, if you route all traffic through the VPS, from WireGuard encryption. One shared vCPU is enough for personal use.

Gotchas on a VPS

• Never open port 53 to the internet. A public resolver is used in DNS amplification attacks against other people. Pi-hole's own WireGuard guide warns about this (guide), hosting providers such as Linode open abuse tickets when they detect one (Linode), and one VPS user heard from a national cybersecurity agency within two days (Reddit). Reach it through WireGuard, Tailscale or another VPN, and allow 53, 80 and 443 only from the tunnel. Check from outside with a site like openresolver.com.
• The Docker example is unsafe on a VPS as written. The official compose file publishes 53:53, 80:80 and 443:443 on every interface and sets the listening mode to ALL (README). On a home LAN that's fine. On a VPS it's an open resolver and a public admin page, and Docker's published ports bypass UFW (Docker docs), so a UFW rule won't save you. Publish the ports on the WireGuard address only (for example 10.8.0.1:53:53/udp), or use the provider's cloud firewall, which sits outside the VPS.
• On a bare install, the default protects you unless you change it. A non-Docker install defaults to "Allow only local requests", so it answers only hosts on subnets the server has an interface on. A WireGuard interface on the same machine counts as local, so it works without switching to "Permit all origins" (docs; Discourse). Don't flip that setting to make something work.
• Free port 53 on Ubuntu first. Ubuntu's systemd-resolved stub listener holds port 53 and stops Pi-hole from binding it. The docs show how to turn off the stub and repoint /etc/resolv.conf (tips and tricks).
• Don't auto-update it. The project asks people not to update the container automatically with tools like Watchtower: read the release notes and update by hand (docs). Your DNS is what every device needs to reach anything, including the fix.
• Keep the clock right and the database small. A wrong system clock sent one v6 install to 2 GB of RAM plus swap (Discourse), and an oversized query database slowed another to a four-minute start (Discourse). Check that NTP is running, and lower database.maxDBdays if you don't need three months of history.

Cheapest plans that fit

Pi-hole plus WireGuard for personal devices: 1 GB RAM and 1+ vCPU

Threshold: Official minimum 512 MB; reports put pihole-FTL at about 70–200 MB, and 1 GB leaves room for the OS, WireGuard and blocklist updates (source). Only plans with at least 1 vCPU are listed.

Pi-hole with very large blocklists: 2 GB RAM and 1+ vCPU

Threshold: Our estimate, not a measurement: a 256 MB VM ran out of memory during a large blocklist update and forum members advise 1 GB or more for large lists (source). Only plans with at least 1 vCPU are listed.

Prices checked Oct 28, 2026 on each provider's official pricing page. EUR prices converted at the ECB rate of Oct 27, 2026 (1 € = $1.115) only for ranking. See all plans on the cheapest 4 GB VPS page.

Related pages

• Pangolin requirements: Pangolin is also built on WireGuard tunnels; if you already run it, keep the Pi-hole admin page behind it rather than public.
• Home Assistant requirements: Home Assistant has a Pi-hole integration for dashboard stats and switching blocking on or off.
• Uptime Kuma requirements: Uptime Kuma has a DNS monitor type, so it can alert you if your Pi-hole stops answering.
• Vaultwarden requirements: Another tiny single-container app that fits on the same 1 GB VPS, also best kept behind a VPN.