How to Deploy Radarr on a VPS

#Prepare the server

This guide assumes Docker Engine and the Compose plugin are installed, along with a non-root user and a ufw firewall. If not, work through Docker & Compose on Ubuntu first.

copysudo ufw allow OpenSSH
sudo ufw allow 80
sudo ufw allow 443
sudo ufw --force enable
sudo ufw status verbose

#Install Radarr (Docker Compose)

The Servarr wiki lists two images; this guide uses linuxserver.io's, which runs as the user you give it through PUID/PGID:

copymkdir -p ~/radarr && cd ~/radarr
mkdir -p config
printf 'PUID=%s\nPGID=%s\n' "$(id -u)" "$(id -g)" > .env

copycd ~/radarr
cat > docker-compose.yml <<'YAML'
services:
  radarr:
    image: lscr.io/linuxserver/radarr:latest
    container_name: radarr
    environment:
      - PUID=${PUID}
      - PGID=${PGID}
      - UMASK=002
      - TZ=Etc/UTC
    volumes:
      - ./config:/config
      # One volume for downloads AND library, so imports are hardlinks.
      - /srv/data:/data
    ports:
      # Loopback only — Caddy is the sole route in from outside.
      - "127.0.0.1:7878:7878"
    restart: unless-stopped
YAML
docker compose up -d

Wait for it to answer:

copycd ~/radarr
for i in $(seq 1 60); do curl -fsS -o /dev/null http://127.0.0.1:7878/ping && break; sleep 2; done
curl -s http://127.0.0.1:7878/ping; echo
docker compose ps

Your download client needs the same - /srv/data:/data mount (or its own subfolder of it), with its save folder set to /data/torrents/movies or /data/usenet/movies.

#HTTPS + domain

Point an A record for radarr.example.com at the server's public IP and wait for it to resolve. Then terminate TLS with Caddy — see Automatic HTTPS with Caddy:

radarr.example.com {
    reverse_proxy 127.0.0.1:7878
}

Running Sonarr on the same box? Add a second block for its hostname to the same Caddyfile. If Caddy runs as a container, share a compose file and proxy to radarr:7878.

#First run

Open https://radarr.example.com. As of Radarr v5, authentication is mandatory, so the first screen asks you to choose a method and create credentials. Pick Forms (Login Page) and keep Authentication Required on Enabled.

Then configure, in this order:

1. Settings → Media Management → Root Folders — add /data/media/movies.
2. Settings → Download Clients — add your client, with the path it sees (/data/torrents/movies or /data/usenet/movies). The shared /data layout means no Remote Path Mapping.
3. Indexers — add them here, or sync them from Prowlarr.
4. Movies → Add New — search for a film and add it.

Two film-specific settings are worth understanding when you add movies:

• Minimum Availability — Announced, In Cinemas or Released. It sets the point at which Radarr starts searching. Films exist in the catalogue long before a release you'd want is available, so Released avoids searching early and grabbing poor early copies.
• Import Lists — Radarr can follow lists (for example from Trakt or TMDb) and add their films automatically, with a quality profile and monitoring already applied.

#Securing it

• Keep Authentication Required on Enabled. The other mode, Disabled for Local Addresses, trusts requests that appear to come from the LAN; the wiki warns that a spoofed X-Forwarded-For header can fake that unless your proxy is listed under Trusted Networks. With Enabled, the question doesn't arise.
• Treat the API key like a password. Prowlarr and request tools use it, and it grants full control of Radarr.
• Keep port 7878 on loopback. The compose file never publishes it.

#Backups

Radarr backs up its own database — by default every 7 days, kept for 28 days — and System → Backup → Backup Now makes one on demand. Those are written with the config, on the same disk, so also copy the config folder off the box:

copycd ~/radarr
docker compose stop
sudo tar czf radarr-config-$(date +%F).tar.gz config docker-compose.yml .env
docker compose start

Stopping first gives a consistent copy of the SQLite database. Restore either through System → Backup → Restore Backup or by putting config back before the container starts. Back up the film library itself like any other large set of files.

#Upgrades

copycd ~/radarr
docker compose pull
docker compose up -d

Updating a Docker install means pulling a new image, not using the in-app updater. Back up first — migrations run on startup.

#Troubleshooting

Imports take minutes and disk use doubles. Hardlinks aren't working. Check that the root folder is /data/media/movies and that the download client reports paths under /data. ls -li on the downloaded file and the imported one should show the same inode number.

"Path does not exist" on import. The download client and Radarr see different paths. Mount /srv/data identically in both, rather than adding a Remote Path Mapping.

A film is monitored but never searched. Check its Minimum Availability: a film set to Released won't be searched while it's only In Cinemas.

The container restarts or the UI won't load. Read the log:

copycd ~/radarr
docker compose logs --tail 50 radarr

#Verification + next steps

You're done when you can load https://radarr.example.com over a valid certificate, sign in on the login page, add a film, see your download client fetch it, and find the renamed file in /srv/data/media/movies as a hardlink of the download.

Next: Sonarr for TV on the same layout, Bazarr for subtitles, Seerr if other people should be able to request films, and Jellyfin to watch them — mount /srv/data/media into it read-only.