Self-host Eclipse Mosquitto

updated Oct 2026deployed by usprices checked · Jul 2026Install verified on Ubuntu 26.04 · Oct 2026 · how we test

We earn commissions when you shop through the links below. Full disclosure →

A lightweight MQTT message broker from the Eclipse Foundation: the publish/subscribe hub that smart-home devices, Zigbee bridges and sensors talk through. A small C program with TLS, authentication and persistence, published as an official Docker image.

Key facts

CategoryHome automation

LicenseEPL-2.0 OR BSD-3-Clause

StackC

Min RAM64 MB

Official imageyes

Measured idle RAM3 MB

Last commitOctober 4, 2026

CheckedGitHub, October 25, 2026

Difficulty

Sourcegithub.com/eclipse-mosquitto/mosquitto

Websitemosquitto.org

Runs on a VPS from $5/mo (Linode Nanode 1 GB, 1 GB RAM) · prices checked Oct 2026

Our recommendation

Pick Eclipse Mosquitto when your sensors, bridges and home-automation apps speak MQTT and you want the lightest broker to put in the middle: it is a small C program from the Eclipse Foundation that handles publish/subscribe messaging, with authentication, TLS listeners and persistence you configure in `mosquitto.conf`. It is dual-licensed EPL-2.0 or EDL-1.0 (BSD-3-Clause). The official image is Alpine-based and its Docker Hub page recommends `latest` or a pinned `2.1*-alpine` tag; ours pins `2.1.2-alpine`. Our snippet writes a minimal config with a password file made by `mosquitto_passwd`, anonymous access off and persistence on, and checks that an authenticated publish is accepted. We did not find an upstream RAM minimum, so our 64 MB floor is an estimate. Mosquitto has no web interface: the catalog's Home Assistant, openHAB and ESPHome are among the things that connect to a broker like this.

What you need

Any VPS with at least 64 MB of RAM
A domain you control — most self-hosted setups need HTTPS in front of them
Under an hour if you've used Docker before

Where to host itaffiliate disclosure

Hetzner Cloudrun it on

From $23.59/mo · 2 vCPU / 4 GB / 80 GB · EU + US

Get Hetzner Cloud

Kamaterafree trial

From $4/mo · 1 vCPU / 1 GB / 20 GB · US + EU + Asia

Start free on Kamatera →

DigitalOceanalso works on

From $6/mo · 1 vCPU / 1 GB / 25 GB · US + EU + Asia

Deploy on DigitalOcean →

Paid link — we earn a commission if you shop through it.

Install

Run these commands on your server:

# Eclipse Mosquitto — MQTT broker — based on the project's Docker image docs, pinned to 2.1.2
MQ_PASS=$(openssl rand -hex 12)
mkdir -p mosquitto/config mosquitto/data
printf 'listener 1883\nallow_anonymous false\npassword_file /mosquitto/config/passwd\npersistence true\npersistence_location /mosquitto/data/\n' > mosquitto/config/mosquitto.conf
docker run --rm -v "$PWD/mosquitto/config:/mosquitto/config" eclipse-mosquitto:2.1.2-alpine mosquitto_passwd -b -c /mosquitto/config/passwd admin "$MQ_PASS"
sudo chown -R 1883:1883 mosquitto
cat > docker-compose.yml <<'EOF'
services:
  mosquitto:
    image: eclipse-mosquitto:2.1.2-alpine
    restart: unless-stopped
    ports:
      - 1883:1883
    volumes:
      - ./mosquitto/config:/mosquitto/config
      - ./mosquitto/data:/mosquitto/data
EOF
docker compose up -d
sleep 5
docker compose exec mosquitto mosquitto_pub -h localhost -u admin -P "$MQ_PASS" -t test/hello -m ok && echo "publish accepted"
# → mqtt://SERVER_IP:1883 as admin (the password is in $MQ_PASS)

vps picksBest VPS for self-hostingbenchmarked quarterly · re-priced monthly

What you take on

The Mosquitto image's Docker Hub page and configuration flag these before you connect devices:

non-negotiableThe image has three directories: /mosquitto/config, /mosquitto/data and /mosquitto/log. The page says the image runs with default configuration values unless you mount your own mosquitto.conf in the config directory, and that you must expose any non-default ports yourself. Our config sets listener 1883, allow_anonymous false and a password_file, and enables persistence under /mosquitto/data/.

non-negotiableThe broker runs as the mosquitto user (UID and GID 1883) and the image's entrypoint changes the ownership of /mosquitto/data to PUID/PGID (default 1883); our snippet sets that ownership on the two bind-mounted folders. The password is generated once and kept only in your shell variable; the passwd file holds its hash.

non-negotiablePort 1883 is unencrypted MQTT, so passwords and messages cross the network in the clear. Keep it on a trusted network, or configure a TLS listener with your own certificates before opening it to the internet; a private CA such as step-ca can issue them.

non-negotiableOld tutorials use the 1.x and 2.0 images: the page lists 2.0.22-openssl and 1.6.15-openssl lines alongside the 2.1 Alpine tags. Read the configuration reference for the line you run, and pin it.

More self-hosted tools

Home automation