Self-hosting is a great hobby up until the third weekend, when the database corrupts, the reverse proxy stops routing, and the family asks why the smart lights work in strange ways. The best apps for self-hosting beginners survive that first month with almost no attention. They ship as Docker images with sane defaults, they update themselves through the same command that starts them, and they do one thing well. We picked seven that a first-time homelab can host next weekend and still be running at Christmas.
What to look for in a beginner self-hosted app
Six things separate a service that ages well from one that owns your Sundays:
- Install shape. Docker Compose file or an appliance-style image. Anything requiring a manual database migration on upgrade will bite.
- Backup story. Whether a single tarball of a directory is enough to restore, or the app needs a database dump first.
- Update cadence. Weekly beta churn is exciting; monthly stable releases are what you actually want.
- Auth surface. Whether it ships with sensible auth, or expects a reverse proxy to add it.
- Resource footprint. RAM idle and under load. A Raspberry Pi 4 can host multiple beginner services; a Pi Zero cannot.
- Documentation. A first-run guide that assumes zero Linux background is the difference between an evening and a month.
Quick comparison
| App | Best for | Runtime | RAM idle | Standout |
|---|---|---|---|---|
| Home Assistant | Smart home hub | HAOS or Docker | 400 MB | Runs the house with zero cloud |
| Pi-hole | Network ad blocking | Docker | 80 MB | Blocks ads on every device |
| Vaultwarden | Password manager | Docker | 60 MB | Bitwarden clients, your data |
| Uptime Kuma | Monitoring dashboard | Docker | 90 MB | See what died before family does |
| Immich | Photo library | Docker | 500 MB | Google Photos replacement |
| Jellyfin | Media streaming | Docker | 300 MB | Plex without the account |
| Portainer | Docker UI | Docker | 60 MB | The dashboard that ties it together |
The apps
1. Home Assistant, best for smart home control
Home Assistant is the open-source smart home hub that treats the local network as the source of truth. Lights, thermostats, sensors, and cameras from over a thousand brands run through it, with automations that live entirely on the LAN. It ships as HAOS (a full appliance image) or as a Docker container. HAOS is the beginner path because it manages its own OS updates.
Where it falls short: The first two weeks are steep. Integrations use YAML files even when the UI mostly replaces them. Third-party add-ons on HAOS are safer than on plain Docker.
Runtime: HAOS on a Pi 4 or a small mini PC, or Docker on any Linux host.
Download: Home Assistant
Bottom line: The pick if smart-home devices already outnumber phones in the house. Start with HAOS on a Pi 4 with an SSD, not the SD card.
2. Pi-hole, best network-wide ad blocker
Pi-hole is a DNS server that returns nothing for the domains on its blocklists. Point the router at it, and every device on the LAN gets ad and tracker blocking, including smart TVs and consoles that no browser extension can reach. The dashboard shows what got blocked in real time.
Where it falls short: If Pi-hole goes down, the whole network loses DNS. Run a second one, or set a fallback DNS on the router. Some services (Google login flows, occasional shopping links) break until whitelisted.
Runtime: Any Linux host, including a Pi Zero 2 W.
Bottom line: Install this second, right after Home Assistant. The whole family sees the difference in a day.
3. Vaultwarden, best self-hosted password manager
Vaultwarden is a Rust reimplementation of the Bitwarden server that runs on 60 MB of RAM and speaks the same protocol as the official clients. Install once, then every Bitwarden app (desktop, mobile, browser) points at the local server. The vault stays on the LAN or on a small VPS.
Where it falls short: Vault export and backup discipline are on the operator. If the SQLite file corrupts and there is no backup, the vault is gone. Run automated backups from day one.
Runtime: Docker on any Linux host.
Download: Vaultwarden
Bottom line: The gateway self-hosted app for anyone already paying for a password manager. Reversible in a week.
4. Uptime Kuma, best beginner monitoring
Uptime Kuma watches the other services and pings a chat channel or email when something dies. HTTP checks, TCP checks, DNS, keyword matching, and status pages all live behind one dashboard. Set it up first, then add every other service in the list to it.
Where it falls short: No fancy metrics. If you want Prometheus and Grafana later, Uptime Kuma will feel small.
Runtime: Docker on any Linux host.
Download: Uptime Kuma
Bottom line: The first service to add so every later service has a working alarm.
5. Immich, best Google Photos replacement
Immich is the closest thing to Google Photos that runs on your own hardware. Mobile apps auto-upload the camera roll to the home server, faces and objects get indexed locally, and the UI covers timeline, albums, sharing, and search. Two years of active development turned it from a curiosity into the recommendation.
Where it falls short: Machine-learning indexing wants a GPU or a beefy CPU for reasonable speed. First import of ten thousand photos can take a whole weekend.
Runtime: Docker on Linux with 4 GB of RAM minimum.
Download: Immich
Bottom line: The pick if the goal is to close the Google Photos account. Do the first import while you sleep.
6. Jellyfin, best free media server
Jellyfin is the fork of Emby that stayed free and open. It streams the family movies, TV, and music to phones, TVs, and browsers on the LAN. No account required, no cloud check-in, no gated hardware transcoding.
Where it falls short: Native TV apps are inconsistent. The Fire TV, Android TV, and web clients are good; the Apple TV app is behind Plex’s.
Runtime: Docker on Linux. Hardware transcoding needs an Intel iGPU or an Nvidia GPU.
Download: Jellyfin
Bottom line: The pick for a Plex user who wants their library off a third-party account.
7. Portainer, best Docker UI for beginners
Portainer is the web UI for Docker. Every service above runs as a container, and a dashboard makes container life much less scary while you learn what docker compose actually does. See logs, restart a stack, edit environment variables, and roll back an update without touching the terminal.
Where it falls short: Advanced multi-host and Kubernetes features live behind Business Edition. The Community Edition is enough for a home lab.
Runtime: Docker on any Linux host.
Bottom line: Install this the same day as the first service. It shortens the learning curve for everything else.
How to pick the order to install
Not every service belongs on day one. Do this order:
- Portainer, so you can see what runs and restart it from a browser.
- Uptime Kuma, so everything after this raises an alarm when it dies.
- Vaultwarden, so the password manager is out of the cloud within the first week.
- Pi-hole, so every device on the LAN benefits before you invite guests over.
- Home Assistant, once smart-home devices are worth automating.
- Jellyfin, when the movie library outgrows the streaming subscriptions.
- Immich, once photo storage on the phone becomes the actual pain.
FAQ
What is the cheapest hardware for self-hosting these? A Raspberry Pi 4 with 4 GB of RAM and an SSD (not the SD card) runs Home Assistant, Pi-hole, Vaultwarden, Uptime Kuma, and Portainer without breaking a sweat. Immich and Jellyfin want a mini PC with an Intel iGPU for real work.
Do I need a domain name? Not for a LAN-only setup. If any service needs to be reachable from outside the house, either a domain plus a reverse proxy or a tunnel like Tailscale is worth the two hours it takes to set up.
What should I not self-host as a beginner? Email is the top of the list. Deliverability to Gmail and Outlook is a moving target that costs you all your evenings. Databases as a service, banking-adjacent apps, and anything storing tax records with no backup discipline all belong on someone else’s servers for the first year.
How do I back these up?
Stop the container, copy the data directory, and start the container. That is enough for every service on this list except Immich, which also wants a Postgres dump. Automate it with restic to an external drive or a remote target.
What is the update path?
Watchtower or docker compose pull && docker compose up -d on a scheduled cron. Read the release notes for Immich and Home Assistant because both have occasionally introduced breaking changes.
Is this legal? Yes. Everything on this list is open-source software. The media library on Jellyfin is your responsibility.
