Docker Container Hosting on a KVM VPS: cgroups v2, Storage Drivers and Security

Docker runs on a KVM VPS exactly as it does on a physical server, because the VPS has its own Linux kernel. Install a current Docker Engine, keep the default overlay2 storage driver, set memory and CPU limits on every container, and treat access to the Docker socket as root access. This guide covers each of those.

Why KVM matters for Docker

Containers share the kernel of the machine they run on. On a KVM VPS that kernel is yours, so the features Docker depends on, such as namespaces, cgroups and the overlay filesystem, are available and under your control. On container-based VPS, those features belong to the host provider.

Step 1: install and check

docker info | grep -E "Storage Driver|Cgroup Version|Cgroup Driver"

On a current distribution you should see the overlay2 storage driver and cgroup version 2. Docker's documentation describes overlay2 as the preferred storage driver for supported Linux distributions.

Step 2: set resource limits

Without limits, one container can consume all memory on the VPS and trigger the kernel's out-of-memory killer against something else. Docker's resource constraints documentation covers memory, CPU and PID limits.

docker run -d --name web --memory=1g --memory-swap=1g --cpus=1.5 --pids-limit=256 nginx

With Docker Compose, set the same limits under each service. cgroups v2, documented in the Linux kernel admin guide, provides the unified hierarchy that enforces these limits.

Step 3: harden the daemon

• The Docker socket is root. Anyone who can reach /var/run/docker.sock can control the host. Do not mount it into containers unless you accept that.
• Consider rootless mode for workloads that do not need privileged features. Docker documents its prerequisites and limitations.
• Do not publish database ports. Bind them to an internal network, or to 127.0.0.1.
• Watch Docker and the firewall. Published ports can bypass simple host firewall rules, so check exposure from outside after every change.
• Enable live restore so running containers keep running while the daemon is restarted or upgraded.

Step 4: storage and cleanup

Images and build cache grow quickly. Schedule docker system prune with care, keep volumes for data, and back volumes up off the server. StreamData's backup policy leaves backups to the customer unless managed backup is ordered.

Sizing

Five of the ten published sizes, from the StreamData KVM VPS plans page. Prices are monthly in INR, excluding GST.

Add up the memory limits of every container plus the host's own needs, and choose a plan with headroom. For image builds and CI, the 9950X VPS plans offer faster single-thread performance with DDR5 memory.

Protection

StreamData positions eligible services behind Cloudflare (Magic Transit-ready) and StormWall partner mitigation paths, chosen by route, workload and location, with a Layer 3 and 4 focus. The DDoS protection page is explicit that no provider can guarantee 100% protection, and that an attacked IP may be temporarily null-routed when traffic exceeds safe levels. Layer 7 abuse still needs rate limits, caching and application controls on your side.

Verify the setup

1. Run docker stats and confirm every container shows a memory limit.
2. From another machine, scan the VPS and confirm only the ports you meant to publish are open.
3. Restart the Docker daemon and confirm containers keep running when live restore is enabled.
4. Restore one volume from backup onto a test VPS.

Compose example with limits

services:
  app:
    image: example/app:1.4
    deploy:
      resources:
        limits: { cpus: "1.0", memory: 768M }
    restart: unless-stopped
  db:
    image: postgres:17
    volumes: [ "pgdata:/var/lib/postgresql/data" ]
volumes:
  pgdata: {}

Keep images small and rebuilt regularly so security fixes in base images reach production, and pin image tags instead of using latest so a redeploy does not change software unexpectedly.

Frequently asked questions

Can I run Kubernetes on a VPS?

Yes. Lightweight distributions such as k3s run well on a KVM VPS. For a production cluster, use at least three nodes so the control plane survives a failure.

How much memory does Docker itself need?

Very little. Plan memory for the containers you run and the operating system.

Where should container data live?

In named volumes or bind mounts that you back up, never only inside the container's writable layer.

Sources

• Docker Docs: Resource constraints
• Docker Docs: OverlayFS storage driver
• Docker Docs: Rootless mode
• Linux kernel documentation: Control Group v2