23 ms·

I just looked at the requirements to host your own Bitwarden server. Why does a password manager need 2GB of ram (4GB recommended) and 25GB[1] of storage? That

I just looked at the requirements to host your own Bitwarden server. Why does a password manager need 2GB of ram (4GB recommended) and 25GB[1] of storage? That seems quite excessive, how much data and traffic does this thing need to handle for me plus family members? [1] https://bitwarden.com/help/install-on-premise-linux/ https://bitwarden.com/help/install-on-premise-linux/

Someone1234 4y ago
Because it uses Docker and that is what Docker requires.
- x3n0ph3n3 4y ago
  No, it's because it uses _several_ docker containers and runs mssql.
  - Someone1234 4y ago
    "No" then go on to reinforce my explanation. Those minimums are taken from Docker. The person above asked why they were what they were, I answered. You're just further reinforcing what I explained.
    - cweagans 4y ago
      Running something in a Docker container adds very very little overhead - to the point that it's almost immeasurable. The resource utilization is specifically because of the services that have been packaged in the containers. If you were running the Bitwarden server on bare metal (which you can definitely do), the requirements would still be the same.
    - x3n0ph3n3 4y ago
      Vaultwarden also uses docker and is a single container with minimal resources.
- turmeric_root 4y ago
  Vaultwarden's Docker images are much smaller: https://hub.docker.com/r/vaultwarden/server https://hub.docker.com/r/vaultwarden/server
- Someone1234 4y ago
  They're literally taken from Docker's website: - https://docs.docker.com/desktop/install/linux-install/ https://docs.docker.com/desktop/install/linux-install/ HN has reached the point, that it will heavily downvote an objective fact because it goes against the pointed narrative. They took a dependency, copied its system requirements, and someone asks "why?" and that is the actual answer. A lot of the other answers (multiple Dockers, slimmer image) really address how Docker themselves have these exact system requirements listed, but why do they need to when the point isn't to answer the actual request asked by get lost into a predisposed critique.
  - deadbunny 4y ago
    Who on earth is using Docker Desktop to run anything but dev? Especially on Linux. Side note: WTF is Docker Desktop on Linux using a VM? I can't even.
  - Dylan16807 4y ago
    You want this page: https://docs.docker.com/engine/install/ https://docs.docker.com/engine/install/ With the requirements on here: https://docs.docker.com/engine/install/binaries/ https://docs.docker.com/engine/install/binaries/ It doesn't even mention space because it's negligible. dockerd uses a few megabytes of ram and around 100MB of drive. Having facts doesn't always mean you're right. Sometimes it's the wrong facts.
alyandon 4y ago
Check out Vaultwarden instead - https://github.com/dani-garcia/vaultwarden https://github.com/dani-garcia/vaultwarden. It is written in Rust and is much lighter on resource requirements. CONTAINER ID NAME CPU % MEM USAGE / LIMIT MEM % NET I/O BLOCK I/O PIDS ecce485b8b3a bitwarden 0.06% 46.58MiB / 1.937GiB 2.35% 1.63MB / 28.1MB 17.5MB / 81.9kB 11
- thewataccount 4y ago
  I've been considering vaultwarden, question though. I assume bitwarden's implementation has been more thoroughly reviewed. Assuming there is a critical bug in vaultwarden, what is the severity/what information is exposed? Is it relatively safe even then because of the E2E?
  - OJFord 4y ago
    Aiui, the server's really just a storage backend implementing the correct API - vaultwarden can't really do any harm, it just stores what the client (encrypts and) tells it to. Worst case it doesn't store, and you still (but only) have a copy on the client.
    - gpm 4y ago
      Eh, worst case you access it via the web-ui, it has been taken over, and it serves a malicious copy of the front-end that steals your password. But... that seems reasonably unlikely.
  - xoa 4y ago
    As well as what sibling said about it being E2EE and just using a standard API for storage, there are awesome tools these days so you can (and I think should) lock down your instance fairly well. Now when I run services like that I access them exclusively via WireGuard or Nebula, no exposure to the public internet at all. It's reliable, dependable and performant enough to pretty much put everything inside of by default. And for something as lightweight as this it should be fine running it at home off of most connections, if you don't have a fixed IP can bounce through even the cheapest VPS instance and still store nothing in the cloud (or run something like Nebula and automate that bit so that it's an encrypted mesh and only a minimal Lighthouse node need be 3rd party). If your instance is just for yourself then even the server can still be another of your devices. Selfhosting absolutely has its challenges and costs but the surface area for exploiting bugs drops a lot when there is no 3rd party or shared environment involved.
suumcuique 4y ago
It includes a MS SQL server among other things, so for serving single digit users its gonna be heavy. Check out Vaultwarden as an alternative for small scale self-hosting.
heresjohnny 4y ago
Honest question: do you believe that you’ll be able to guarantee the same/better uptime, performance, and security compared to the SaaS version? Hosting your own password manager seems like something you really shouldn’t do, just like hosting your own e-mail. This stuff is critical to your life.
- zikduruqe 4y ago
  Just use passwordstore.org and stand up a bare git repo. It really doesn't need to be terribly complicated.
- sam_goody 4y ago
  Sure. Hosting your own is a twenty minute setup, more or less, and $5/mo on Hetzner. Uptime, in my experience, is 5 nines. With SaaS, I am losing the main reason that I am using Bitwarden - that I don't want the X agency to force Bitwarden to give them my passwords. And I know that if said agency (it varies by country and target) could definitely hack the VPS if I was important enough, that is not part of my threat profile. Self hosted is far less likely to get auto vacuumed than SaaS data.
  - idiotsecant 4y ago
    I think if X agency wants your information the $5 wrench attack will probably bypass your self-hosted server infrastructure.
    - Dylan16807 4y ago
      Ok. There's a very big gap between a warrant and a torture kidnapping. Self-hosting protects a lot of that gap.
    - midasuni 4y ago
      If X agency uses the wrench attack then you know you’ve been breached
    - denkmoon 4y ago
jve 4y ago
I'm hosting Bitwarden on RPI4B, but using bitwarden-rs lightweight server. Along with nextcloud, home assistant and photo gallery. Well, yes, after adding photo gallery, I now want a faster device.

Someone1234 4y ago

Because it uses Docker and that is what Docker requires.

x3n0ph3n3 4y ago
No, it's because it uses _several_ docker containers and runs mssql.
- Someone1234 4y ago
  "No" then go on to reinforce my explanation. Those minimums are taken from Docker. The person above asked why they were what they were, I answered. You're just further reinforcing what I explained.
  - cweagans 4y ago
    Running something in a Docker container adds very very little overhead - to the point that it's almost immeasurable. The resource utilization is specifically because of the services that have been packaged in the containers. If you were running the Bitwarden server on bare metal (which you can definitely do), the requirements would still be the same.
  - x3n0ph3n3 4y ago
    Vaultwarden also uses docker and is a single container with minimal resources.
turmeric_root 4y ago
Vaultwarden's Docker images are much smaller: https://hub.docker.com/r/vaultwarden/server https://hub.docker.com/r/vaultwarden/server
Someone1234 4y ago
They're literally taken from Docker's website: - https://docs.docker.com/desktop/install/linux-install/ https://docs.docker.com/desktop/install/linux-install/ HN has reached the point, that it will heavily downvote an objective fact because it goes against the pointed narrative. They took a dependency, copied its system requirements, and someone asks "why?" and that is the actual answer. A lot of the other answers (multiple Dockers, slimmer image) really address how Docker themselves have these exact system requirements listed, but why do they need to when the point isn't to answer the actual request asked by get lost into a predisposed critique.
- deadbunny 4y ago
  Who on earth is using Docker Desktop to run anything but dev? Especially on Linux. Side note: WTF is Docker Desktop on Linux using a VM? I can't even.
- Dylan16807 4y ago
  You want this page: https://docs.docker.com/engine/install/ https://docs.docker.com/engine/install/ With the requirements on here: https://docs.docker.com/engine/install/binaries/ https://docs.docker.com/engine/install/binaries/ It doesn't even mention space because it's negligible. dockerd uses a few megabytes of ram and around 100MB of drive. Having facts doesn't always mean you're right. Sometimes it's the wrong facts.

alyandon 4y ago

Check out Vaultwarden instead - https://github.com/dani-garcia/vaultwarden https://github.com/dani-garcia/vaultwarden. It is written in Rust and is much lighter on resource requirements. CONTAINER ID NAME CPU % MEM USAGE / LIMIT MEM % NET I/O BLOCK I/O PIDS ecce485b8b3a bitwarden 0.06% 46.58MiB / 1.937GiB 2.35% 1.63MB / 28.1MB 17.5MB / 81.9kB 11

thewataccount 4y ago
I've been considering vaultwarden, question though. I assume bitwarden's implementation has been more thoroughly reviewed. Assuming there is a critical bug in vaultwarden, what is the severity/what information is exposed? Is it relatively safe even then because of the E2E?
- OJFord 4y ago
  Aiui, the server's really just a storage backend implementing the correct API - vaultwarden can't really do any harm, it just stores what the client (encrypts and) tells it to. Worst case it doesn't store, and you still (but only) have a copy on the client.
  - gpm 4y ago
    Eh, worst case you access it via the web-ui, it has been taken over, and it serves a malicious copy of the front-end that steals your password. But... that seems reasonably unlikely.
- xoa 4y ago
  As well as what sibling said about it being E2EE and just using a standard API for storage, there are awesome tools these days so you can (and I think should) lock down your instance fairly well. Now when I run services like that I access them exclusively via WireGuard or Nebula, no exposure to the public internet at all. It's reliable, dependable and performant enough to pretty much put everything inside of by default. And for something as lightweight as this it should be fine running it at home off of most connections, if you don't have a fixed IP can bounce through even the cheapest VPS instance and still store nothing in the cloud (or run something like Nebula and automate that bit so that it's an encrypted mesh and only a minimal Lighthouse node need be 3rd party). If your instance is just for yourself then even the server can still be another of your devices. Selfhosting absolutely has its challenges and costs but the surface area for exploiting bugs drops a lot when there is no 3rd party or shared environment involved.

suumcuique 4y ago

It includes a MS SQL server among other things, so for serving single digit users its gonna be heavy. Check out Vaultwarden as an alternative for small scale self-hosting.

heresjohnny 4y ago

Honest question: do you believe that you’ll be able to guarantee the same/better uptime, performance, and security compared to the SaaS version? Hosting your own password manager seems like something you really shouldn’t do, just like hosting your own e-mail. This stuff is critical to your life.

zikduruqe 4y ago
Just use passwordstore.org and stand up a bare git repo. It really doesn't need to be terribly complicated.
sam_goody 4y ago
Sure. Hosting your own is a twenty minute setup, more or less, and $5/mo on Hetzner. Uptime, in my experience, is 5 nines. With SaaS, I am losing the main reason that I am using Bitwarden - that I don't want the X agency to force Bitwarden to give them my passwords. And I know that if said agency (it varies by country and target) could definitely hack the VPS if I was important enough, that is not part of my threat profile. Self hosted is far less likely to get auto vacuumed than SaaS data.
- idiotsecant 4y ago
  I think if X agency wants your information the $5 wrench attack will probably bypass your self-hosted server infrastructure.
  - Dylan16807 4y ago
    Ok. There's a very big gap between a warrant and a torture kidnapping. Self-hosting protects a lot of that gap.
  - midasuni 4y ago
    If X agency uses the wrench attack then you know you’ve been breached
  - denkmoon 4y ago

jve 4y ago

I'm hosting Bitwarden on RPI4B, but using bitwarden-rs lightweight server. Along with nextcloud, home assistant and photo gallery. Well, yes, after adding photo gallery, I now want a faster device.