PocketBase is an open-source backend in a single executable file: an embedded SQLite database, user authentication (email and OAuth2), file storage, realtime subscriptions and an admin dashboard. Download one binary, run it, and you have a backend for a web or mobile app. It’s ideal for side projects, MVPs, internal tools and small production apps on a modest VPS.

Need more scale or PostgreSQL? See Supabase self-hosted and Appwrite.

Install

sudo useradd -r -m -d /opt/pocketbase -s /usr/sbin/nologin pocketbase
cd /opt/pocketbase
sudo -u pocketbase wget https://github.com/pocketbase/pocketbase/releases/download/v0.25.0/pocketbase_0.25.0_linux_amd64.zip
sudo -u pocketbase unzip pocketbase_*_linux_amd64.zip && sudo -u pocketbase rm pocketbase_*_linux_amd64.zip

(Use the latest release. Note that PocketBase is pre-1.0, so read the changelog for breaking changes between versions.)

Run it as a systemd service

# /etc/systemd/system/pocketbase.service
[Unit]
Description=PocketBase
After=network.target

[Service]
User=pocketbase
WorkingDirectory=/opt/pocketbase
ExecStart=/opt/pocketbase/pocketbase serve --http=127.0.0.1:8090
Restart=on-failure
LimitNOFILE=4096
NoNewPrivileges=true

[Install]
WantedBy=multi-user.target
sudo systemctl daemon-reload && sudo systemctl enable --now pocketbase

Data lives in /opt/pocketbase/pb_data (the SQLite databases plus uploaded files). See systemd unit files.

Nginx with HTTPS

server {
    server_name api.example.com;
    client_max_body_size 20M;
    location / {
        proxy_pass http://127.0.0.1:8090;
        proxy_http_version 1.1;
        proxy_set_header Connection '';        # keep realtime (SSE) connections open
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 360s;
        proxy_buffering off;
    }
    # listen 443 ssl; certbot --nginx -d api.example.com
}

PocketBase’s realtime uses Server-Sent Events, so disable buffering. See Let’s Encrypt.

Open https://api.example.com/_/ and create the superuser account. Do it right away, or create the superuser from the CLI before exposing the server:

sudo -u pocketbase ./pocketbase superuser create [email protected] 'a-long-password'

Collections and API rules

In the dashboard:

  1. Create collections (tables), with fields (text, number, relation, file, JSON…).
  2. Use the built-in users auth collection for signup and login (email/password, OAuth2 with Google, GitHub and others).
  3. Set API rules per collection and action. These are filter expressions deciding who can list, view, create, update and delete:
// only the owner can read and modify their records
@request.auth.id != "" && user = @request.auth.id

Empty rules mean “superusers only”. Getting rules right is the core of PocketBase security.

Use it from your frontend

import PocketBase from 'pocketbase';
const pb = new PocketBase('https://api.example.com');
await pb.collection('users').authWithPassword('[email protected]', 'password');
const notes = await pb.collection('notes').getList(1, 20, { sort: '-created' });
pb.collection('notes').subscribe('*', e => console.log(e.action, e.record));

SDKs exist for JavaScript and Dart (Flutter). Everything else uses the REST API.

Extend it

  • JavaScript hooks in pb_hooks/*.pb.js: custom routes, validation, sending emails, cron jobs.
  • Go: use PocketBase as a framework, and compile your own binary with custom logic.

Email

Configure SMTP in Settings → Mail settings for verification and password reset emails. See transactional email services.

Backups

PocketBase has built-in backups (Settings → Backups): scheduled ZIP archives of pb_data, optionally uploaded to S3-compatible storage. Also copy them off-server yourself, and keep a few versions. See backup strategy and MinIO.

Limits to know

  • SQLite means a single server. It handles a lot (thousands of requests per second for typical apps), but there’s no horizontal scaling or multi-node writes.
  • The pre-1.0 API can change between releases. Pin versions, and test upgrades.
  • For complex SQL, heavy analytics or many writers, consider PostgreSQL-based stacks. See SQLite vs PostgreSQL.

Quick reference

Task Command / path
Run ./pocketbase serve --http=127.0.0.1:8090
Dashboard /_/
Create superuser ./pocketbase superuser create EMAIL PASS
Data pb_data/
Hooks pb_hooks/*.pb.js
Backups Settings → Backups (S3 optional)

Related: NocoDB and install SQLite.

  • Self-Hosting
  • Web Development
  • Backend