Self-host Milvus
updated Oct 2026deployed by usprices checked · Jul 2026Install verified on Ubuntu 26.04 · Oct 2026 · how we test
We earn commissions when you shop through the links below. Full disclosure →
A vector database built for similarity search over embeddings at scale: collections with multiple index types, scalar filtering, hybrid dense-plus-sparse search, partitions and role-based access, served over gRPC and a REST API with SDKs for Python, Go, Java and Node.js. Apache-2.0 licensed, written in Go and C++; in standalone mode it runs as one Milvus container that depends on etcd for metadata and MinIO (or S3) for the vectors themselves, with the message queue embedded.
Key facts
CategoryVector database
LicenseApache-2.0
StackGo, C++, etcd, MinIO
Min RAM8192 MB
Official imageyes
Measured idle RAM195 MB
Last commitOctober 23, 2026
Last releasev3.0.3, October 14, 2026
CheckedGitHub, October 25, 2026
Difficulty
Websitemilvus.io (opens in new tab)
Runs on a VPS from $82.59/mo (Hetzner Cloud CPX42, 16 GB RAM) · prices checked Sep 2026
Our recommendation
Pick Milvus when your vector workload is going to outgrow a single-process database: it indexes dense and sparse embeddings with several index types, filters on scalar fields, runs hybrid searches, partitions large collections and ships SDKs for Python, Go, Java and Node.js, and the same API moves unchanged from this standalone deployment to the distributed cluster. It is Apache-2.0 Go and C++. Our snippet is upstream's standalone compose file from the GitHub release: Milvus plus etcd for metadata and MinIO for the vector files, with the MinIO credentials generated into `.env` (upstream ships `minioadmin`/`minioadmin`) and MinIO's API and console ports no longer published to the host. Upstream's Docker prerequisites set the floor at 8 GB of RAM with 16 GB recommended, which is our documented floor and the reason this is the heaviest entry in its category. The catalog's Qdrant and Weaviate each run as one container; pick one of them for a small project and Milvus when you want its cluster path and accept the etcd/MinIO architecture as the price.
What you need
- Any VPS with at least 8192 MB of RAM
- A domain you control — most self-hosted setups need HTTPS in front of them
- About an afternoon — budget time for troubleshooting
Where to host itaffiliate disclosure
Hetzner Cloudrun it on
From $23.59/mo · 2 vCPU / 4 GB / 80 GB · EU + USKamaterafree trial
From $4/mo · 1 vCPU / 1 GB / 20 GB · US + EU + AsiaDigitalOceanalso works on
From $6/mo · 1 vCPU / 1 GB / 25 GB · US + EU + AsiaPaid link — we earn a commission if you shop through it.
Install
Run these commands on your server:
# Milvus — vector database for similarity search over embeddings — based on upstream's milvus-standalone-docker-compose.yaml from the GitHub release (etcd + MinIO + standalone), pinned to v3.0.3
echo "MINIO_ACCESS_KEY=$(openssl rand -hex 8)" > .env
echo "MINIO_SECRET_KEY=$(openssl rand -hex 16)" >> .env
cat > docker-compose.yml <<'EOF'
x-milvus-image: &milvus-image milvusdb/milvus:v3.0.3
services:
milvus-volume-init:
image: *milvus-image
user: "0:0"
network_mode: none
read_only: true
restart: "no"
entrypoint: ["/bin/sh", "-c"]
command:
- |
set -eu
uid="$$(id -u milvus)"
gid="$$(id -g milvus)"
marker="/var/lib/milvus/.milvus-volume-owner-$${uid}-$${gid}"
if [ ! -e "$${marker}" ]; then
chown -R "$${uid}:$${gid}" /var/lib/milvus
touch "$${marker}"
chown "$${uid}:$${gid}" "$${marker}"
fi
volumes:
- ./volumes/milvus:/var/lib/milvus
etcd:
image: quay.io/coreos/etcd:v3.5.25
restart: unless-stopped
environment:
- ETCD_AUTO_COMPACTION_MODE=revision
- ETCD_AUTO_COMPACTION_RETENTION=1000
- ETCD_QUOTA_BACKEND_BYTES=4294967296
- ETCD_SNAPSHOT_COUNT=50000
volumes:
- ./volumes/etcd:/etcd
command: etcd -advertise-client-urls=http://etcd:2379 -listen-client-urls http://0.0.0.0:2379 --data-dir /etcd
healthcheck:
test: ["CMD", "etcdctl", "endpoint", "health"]
interval: 30s
timeout: 20s
retries: 3
minio:
image: milvusdb/minio:RELEASE.2024-12-18T13-15-44Z
restart: unless-stopped
environment:
MINIO_ACCESS_KEY: ${MINIO_ACCESS_KEY}
MINIO_SECRET_KEY: ${MINIO_SECRET_KEY}
volumes:
- ./volumes/minio:/minio_data
command: minio server /minio_data --console-address ":9001"
healthcheck:
test: ["CMD", "mc", "ready", "local"]
interval: 30s
timeout: 20s
retries: 3
standalone:
image: *milvus-image
restart: unless-stopped
command: ["milvus", "run", "standalone"]
security_opt:
- seccomp:unconfined
environment:
MINIO_REGION: us-east-1
ETCD_ENDPOINTS: etcd:2379
MINIO_ADDRESS: minio:9000
MINIO_ACCESS_KEY_ID: ${MINIO_ACCESS_KEY}
MINIO_SECRET_ACCESS_KEY: ${MINIO_SECRET_KEY}
volumes:
- ./volumes/milvus:/var/lib/milvus
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:9091/healthz"]
interval: 30s
start_period: 90s
timeout: 20s
retries: 3
ports:
- 19530:19530
- 9091:9091
depends_on:
milvus-volume-init:
condition: service_completed_successfully
etcd:
condition: service_started
minio:
condition: service_started
EOF
docker compose up -d
# standalone reports healthy only once etcd and MinIO are reachable and its own components are up
timeout 300 bash -c 'until curl -fsS http://localhost:9091/healthz >/dev/null; do sleep 5; done'
# → http://SERVER_IP:9091/webui/ — built-in web console, no login (the management port is unauthenticated by default); SDKs connect to the gRPC port 19530What you take on
Milvus's install docs, release compose file and `milvus.yaml` set out what is open or fixed by default:
non-negotiableAuthentication is off: common.security.authorizationEnabled defaults to false in milvus.yaml, and when you turn it on the built-in root user starts with the password Milvus (defaultRootPassword), which you then rotate with UpdateCredential. The management port 9091, which serves the web console, pprof and /healthz, is also unauthenticated unless adminAuthEnabled is set, and upstream's comment notes it stays plaintext either way. Our snippet publishes 19530 and 9091 on all interfaces, as upstream's file does.
non-negotiableEverything persists in three bind-mounted directories under ./volumes/ (milvus, etcd, minio). The milvus-volume-init one-shot service from upstream's file chowns the Milvus directory to the image's milvus user before the first start and leaves a marker so it does not run again; upstream's comment says to remove the marker after restoring files owned by a different user. Back up all three together, since etcd holds the metadata that makes the MinIO objects meaningful.
non-negotiableThe release file pins milvusdb/milvus, quay.io/coreos/etcd and milvusdb/minio to exact tags, which we kept; Docker Hub's rolling <major.minor>-<date> and master-<date> tags are nightly builds, not releases. We pass the generated MinIO keys to Milvus as MINIO_ACCESS_KEY_ID and MINIO_SECRET_ACCESS_KEY, the environment names milvus.yaml documents for minio.accessKeyID and minio.secretAccessKey, and to MinIO under the names upstream's compose uses. Upstream also sets security_opt: seccomp:unconfined on the standalone container.
non-negotiableClients speak gRPC to 19530 and the console is plain HTTP on 9091; neither has TLS by default, so keep both behind a firewall or a TLS proxy. Upstream's prerequisites ask for 4 or more cores, a CPU with SSE4.2, AVX, AVX2 or AVX-512, and an SSD, with etcd wanting low fsync latency (the docs suggest an NVMe disk), so a budget VPS with slow disks or a CPU without those instruction sets is the wrong box.
An alternative to
More self-hosted tools
Vector database
Qdrant
Rust
easyRead guide →
Vector database
Weaviate
Go
easyRead guide →
File sync & storage
Syncthing
Go
easyRead guide →
SSO & Identity
Tinyauth
Go
easyRead guide →