1. Home
2. Tools
3. PocketBase for Startups

Why PocketBase is a great fit for startups

Early-stage startups face a brutal infrastructure dilemma. Firebase is expensive at scale and creates vendor lock-in. Supabase is excellent but complex to self-host. Building your own backend from scratch takes months. And managed services like AWS Amplify or Heroku erode your runway before you've validated anything.

PocketBase sits in a different category entirely. It's a single executable file — no Docker, no Kubernetes, no external dependencies. You drop it on a $6/month server and you have a production-grade backend running in under 10 minutes.

Production setup: step by step

The following is exactly how Exponanta deployed PocketBase to production at pb.exponanta.com. This runs on Ubuntu 24.04 LTS on a DigitalOcean Basic droplet ($6/month). Every command is copy-pasteable.

Create a new Ubuntu 24.04 LTS droplet on DigitalOcean (or any VPS provider). During setup, add your SSH public key so you can connect without a password.

Get your public key on Windows:

type $env:USERPROFILE\.ssh\id_ed25519.pub

If you don't have an SSH key yet, generate one first:

ssh-keygen -t ed25519 -C "you@example.com"

Once the droplet is running, connect via the DigitalOcean browser console or SSH. Update the system first:

apt update && apt upgrade -y

PocketBase needs only unzip and curl. That's it.

apt install -y unzip curl

mkdir -p /root/pb/pb_migrations /root/pb/pb_hooks
cd /root/pb

curl -L https://github.com/pocketbase/pocketbase/releases/download/v0.26.6/pocketbase_0.26.6_linux_amd64.zip \
  -o pocketbase.zip

unzip pocketbase.zip
rm pocketbase.zip
chmod +x pocketbase

Check the PocketBase releases page for the latest version and update the URL accordingly.

Running PocketBase as a systemd service means it starts automatically on boot, restarts on crash, and runs in the background without you needing to stay connected.

cat > /lib/systemd/system/pocketbase.service << 'EOF'
[Unit]
Description=pocketbase

[Service]
Type=simple
User=root
Group=root
LimitNOFILE=4096
Restart=always
RestartSec=5s
StandardOutput=append:/root/pb/std.log
StandardError=append:/root/pb/std.log
WorkingDirectory=/root/pb
ExecStart=/root/pb/pocketbase serve --http=0.0.0.0:8090

[Install]
WantedBy=multi-user.target
EOF

Enable and start the service:

systemctl enable pocketbase.service
systemctl start pocketbase
systemctl status pocketbase

You should see Active: active (running). PocketBase is now live on port 8090.

/root/pb/pocketbase superuser create your@email.com yourpassword

PocketBase runs on port 8090 internally. NGINX sits in front of it on port 80 (and later 443 for HTTPS), handling SSL termination and giving you a clean URL.

apt install -y nginx

cat > /etc/nginx/sites-available/pocketbase << 'EOF'
server {
    listen 80;
    server_name pb.yourdomain.com;
    client_max_body_size 10M;

    location / {
        proxy_set_header Connection '';
        proxy_http_version 1.1;
        proxy_read_timeout 360s;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_pass http://127.0.0.1:8090;
    }
}
EOF

ln -s /etc/nginx/sites-available/pocketbase /etc/nginx/sites-enabled/
rm /etc/nginx/sites-enabled/default
nginx -t
systemctl restart nginx
ufw allow 80
ufw allow 22
ufw enable

Add an A record in your DNS provider pointing your subdomain to the server IP:

Once DNS propagates (verify with ping pb.yourdomain.com), install Certbot and get a free Let's Encrypt certificate:

apt install -y certbot python3-certbot-nginx
certbot --nginx -d pb.yourdomain.com

Certbot will ask for your email, accept terms, then automatically configure NGINX for HTTPS and set up auto-renewal.

ufw allow 443

Your PocketBase admin UI is now at https://pb.yourdomain.com/_/

PocketBase sends emails for verification, password reset, and auth alerts. By default it uses the server's sendmail — which will be marked as spam by every major mail provider. Set up Mailgun SMTP instead.

In the PocketBase dashboard, go to Settings → Mail settings and fill in:

Click Send test email to verify delivery before going live.

Go to Settings → Application and enable rate limiting. The defaults are sensible and protect against brute-force auth attacks immediately:

Day-to-day commands

Once running, you rarely need to touch the server. These are the commands you'll use:

# Check if PocketBase is running
systemctl status pocketbase

# Restart after config changes
systemctl restart pocketbase

# Watch live logs
tail -f /root/pb/std.log

# Restart NGINX
systemctl restart nginx

The 3 things that will trip you up

We hit all three of these. Save yourself the time.

What you get at the end

For Exponanta, PocketBase handles everything from participant auth to the event scheduling data powering our Demo Day 1:1 dashboard. It's not a toy — it's a serious backend that scales far beyond where most startups need it, at a cost that preserves runway for what actually matters.