Self-host OpenBao

updated Sep 2026deployed by usprices checked · Jul 2026Install verified on Ubuntu 26.04 · Sep 2026 · how we test

We earn commissions when you shop through the links below. Full disclosure →

A community fork of HashiCorp Vault under the Linux Foundation, kept under the MPL-2.0 license after Vault moved to the BSL. It stores and issues secrets, certificates and encryption keys through a Vault-compatible API, CLI and web UI.

Key facts

CategorySecrets management

LicenseMPL-2.0

StackGo

Min RAM256 MB

Official imageyes

Measured idle RAM20 MB

Difficulty

Sourcegithub.com/openbao/openbao

Websiteopenbao.org

What you need

Any VPS with at least 256 MB of RAM
A domain you control — most self-hosted setups need HTTPS in front of them
About an afternoon — budget time for troubleshooting

Where to host itaffiliate disclosure

Hetzner Cloudrun it on

From $23.59/mo · 2 vCPU / 4 GB / 80 GB · EU + US

Get Hetzner Cloud

Kamaterafree trial

From $4/mo · 1 vCPU / 1 GB / 20 GB · US + EU + Asia

Start free on Kamatera →

DigitalOceanalso works on

From $6/mo · 1 vCPU / 1 GB / 25 GB · US + EU + Asia

Deploy on DigitalOcean →

Paid link — we earn a commission if you shop through it.

Install

Run these commands on your server:

# OpenBao — single node, Raft storage on a named volume, UI on :8200
docker run -d --name openbao --restart unless-stopped --memory-swappiness=0 \
  -p 8200:8200 -v openbao-data:/openbao/file -e BAO_ADDR=http://127.0.0.1:8200 \
  -e 'BAO_LOCAL_CONFIG={"storage":{"raft":{"path":"/openbao/file","node_id":"node1"}},"listener":[{"tcp":{"address":"0.0.0.0:8200","tls_disable":true}}],"api_addr":"http://127.0.0.1:8200","cluster_addr":"http://127.0.0.1:8201","disable_mlock":true,"ui":true}' \
  openbao/openbao:2.7.0 server
# initialize once — writes the unseal key + root token to a file: move it offline
sleep 5 && docker exec openbao bao operator init -key-shares=1 -key-threshold=1 > openbao-init.txt
docker exec openbao bao operator unseal "$(awk '/Unseal Key 1/{print $NF}' openbao-init.txt)"
# →  http://SERVER_IP:8200/ui  (sign in with the Initial Root Token)