Deployment guide

PocketBase

Overview

PocketBase is an open-source backend in a single Go binary. It bundles an embedded SQLite database, a realtime REST and Server-Sent-Events API, built-in authentication, file storage and an admin dashboard. That is everything you need to back a web or mobile app without a separate database, API layer and auth service.

The SecureAnyCloud image installs PocketBase 0.39.4 and runs it as a systemd service bound to loopback behind an nginx reverse proxy on port 80. It generates a unique superuser on the first boot of every VM.

What you get:

PocketBase 0.39.4 (binary /usr/local/bin/pocketbase) with an embedded SQLite database
nginx on :80 as a reverse proxy to the loopback PocketBase backend, with WebSocket and SSE upgrade headers for realtime subscriptions
A per-VM admin (superuser) account generated on first boot and recorded in a root-only file
A dedicated Azure data disk at /var/lib/pocketbase that holds the database (pb_data) and file storage
pocketbase.service and nginx.service as enabled and active systemd units
24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting size, because PocketBase is lightweight.

In the network security group, allow inbound 22/tcp from your management network and 80/tcp. PocketBase serves plain HTTP on port 80. For production, terminate TLS in front of it with your own domain.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for PocketBase by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab. Then select Review + create, and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:pocketbase-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name pocketbase \
  --image sac1647283583153:pocketbase-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name pocketbase --port 80 --priority 1010

Step 3 - Connect to your VM

Connect over SSH:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Check that both services are running:

systemctl is-active pocketbase.service nginx.service

Both report active. On first boot, PocketBase creates a per-VM superuser.

Step 5 - Retrieve your admin password

The admin (superuser) password is generated uniquely on the first boot of your VM and written to a root-only file:

sudo cat /root/pocketbase-credentials.txt

The file contains POCKETBASE_ADMIN_EMAIL (admin@sac.local) and pocketbase.admin.pass. Store the password somewhere safe.

Step 6 - Confirm the health endpoint

PocketBase exposes an unauthenticated health endpoint for load balancers and probes:

curl -s http://localhost/api/health

It returns a JSON object with "code":200 and "message":"API is healthy.".

Step 7 - Open the admin dashboard

Browse to http://<vm-public-ip>/_/ and sign in as admin@sac.local with the password from Step 5. The dashboard is where you manage collections, records, users, files and settings.

After you sign in, the Collections view opens. Each collection is a table with its own schema, API rules and realtime channel.

Select any record to open the record editor, where you can view and edit field values inline.

The Settings area covers the application name and URL, mail, file storage, backups, scheduled jobs and more.

Step 8 - Verify authentication from the command line

PocketBase's superuser auth endpoint rejects a wrong password and accepts the per-VM admin password. First read the password into a variable. Then authenticate:

PB_PASS=$(sudo grep '^pocketbase.admin.pass=' /root/pocketbase-credentials.txt | cut -d= -f2-)
curl -s -X POST -H 'Content-Type: application/json' -d "{\"identity\":\"admin@sac.local\",\"password\":\"$PB_PASS\"}" http://localhost:8090/api/collections/_superusers/auth-with-password | head -c 120; echo

The response contains a "token" field. That JWT authenticates subsequent admin API calls.

Step 9 - Create your first collection from the API

You can manage everything from the dashboard or script it against the REST API. Authenticate and create a notes collection:

PB_PASS=$(sudo grep '^pocketbase.admin.pass=' /root/pocketbase-credentials.txt | cut -d= -f2-)
PB_TOKEN=$(curl -s -X POST -H 'Content-Type: application/json' -d "{\"identity\":\"admin@sac.local\",\"password\":\"$PB_PASS\"}" http://localhost:8090/api/collections/_superusers/auth-with-password | python3 -c "import sys,json;print(json.load(sys.stdin)['token'])")
curl -s -X POST -H "Authorization: $PB_TOKEN" -H 'Content-Type: application/json' -d '{"name":"notes","type":"base","fields":[{"name":"text","type":"text","required":true}]}' http://localhost:8090/api/collections | python3 -c "import sys,json;d=json.load(sys.stdin);print('created collection:', d.get('name','?'))"

It prints created collection: notes. The collection is immediately available at /api/collections/notes/records with a realtime channel.

Step 10 - Confirm data lives on the dedicated disk

The PocketBase database and file storage are stored on the dedicated Azure data disk so they survive OS changes and can be resized independently:

findmnt /var/lib/pocketbase

The mount is backed by a separate Azure data disk that is captured into the image and re-provisioned on every VM. The pb_data directory (SQLite database plus uploaded files) lives under it.

Building your app

PocketBase is designed to be your app's entire backend. Point the official JavaScript/Dart SDKs (or any HTTP client) at http://<your-domain>/.

Use collections for data, auth collections for user sign-up and login, realtime subscriptions for live updates, and the files API for uploads. You can extend PocketBase with JavaScript hooks (pb_hooks) or use it as a Go framework. See the PocketBase documentation for SDKs, API rules and hooks.

Maintenance

Admin users: add or manage superusers from the dashboard, or with pocketbase superuser on the VM.
Backups: use the built-in Backups settings, or snapshot the /var/lib/pocketbase data disk.
Data: the SQLite database and uploaded files live under /var/lib/pocketbase/pb_data.
TLS: PocketBase serves plain HTTP on port 80. Front it with TLS (for example, certbot) and your own domain for production.
Upgrades: replace /usr/local/bin/pocketbase with a newer release binary and sudo systemctl restart pocketbase.
Security patches: unattended-upgrades stays enabled, so the OS keeps receiving security updates automatically.

Support

SecureAnyCloud provides 24/7 support for this image. Contact sales@secureanycloud.com.

Deploy on Azure

Launch PocketBase on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

This image runs PocketBase, the open-source backend that bundles an embedded SQLite database, realtime subscriptions, built-in user authentication, file storage and an admin dashboard into a single portable binary. It gives you a production-grade REST and realtime API for your web and mobile applications without a separate database server.

What you get:

The PocketBase binary under /opt/pocketbase, running as a dedicated unprivileged pocketbase system account under a systemd service that starts it on boot and restarts it on failure
The application data directory pb_data, which holds the embedded SQLite database, uploaded files and migrations, at /var/lib/pocketbase/pb_data on a dedicated, independently resizable EBS data volume
PocketBase bound to the loopback interface only and published on port 80 by an nginx reverse proxy
PocketBase's own authentication: the admin dashboard at /_/ is gated by a superuser login, and your own user collections each have their own auth
A superuser password generated on the first boot of every deployed instance, so two instances launched from the same Amazon Machine Image never share a password

The superuser password is written to /root/pocketbase-credentials.txt with mode 0600, so only the root user can read it.

Prerequisites

Before you deploy this image, you need:

An Amazon Web Services account where you can launch EC2 instances
IAM permissions to launch instances, create security groups, and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access to the instance
A VPC and subnet in the target Region, with a security group allowing inbound port 22 from your management network and port 80 for the dashboard and the API
The AWS CLI (version 2) installed locally if you plan to deploy from the command line

Launch the instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for PocketBase.

Select the SecureAnyCloud listing and choose Select. Then choose Continue on the subscription summary.

Pick an instance type of t3.small or larger. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet. Create or select a security group that opens port 22 from your management network and port 80 for the dashboard and the API. Leave the root volume at the default size or larger.

Select Launch instance. First boot initialization takes a few seconds after the instance state becomes Running and the status checks pass.

Launch the instance from the AWS CLI

The following block launches an instance from the SecureAnyCloud PocketBase Marketplace AMI into an existing subnet and security group.

Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, and <subnet-id> with your subnet ID. Replace <security-group-id> with a security group that opens ports 22 and 80 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type t3.small \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=pocketbase}]'

When the instance reaches the Running state and its status checks pass, note its public IP address or DNS name from the EC2 console or with aws ec2 describe-instances.

Connect to your instance

Connect over SSH using your key pair. On Ubuntu 24.04, the SSH login user is ubuntu.

ssh -i <key-name>.pem ubuntu@<public-ip>

Retrieve the superuser password

The dashboard superuser password is unique to your instance and was generated on first boot. Read it as root:

sudo cat /root/pocketbase-credentials.txt

The file lists the dashboard URL, the superuser email (admin@sac.local) and the generated password, along with the API endpoints. Keep this password somewhere safe.

Sign in to the admin dashboard

nginx serves the PocketBase admin dashboard on port 80 at the /_/ path. In a browser, go to:

http://<instance-public-ip>/_/

Sign in with the superuser email admin@sac.local and the password from the credentials file. The dashboard opens on the Collections view, which lists the built-in users collection and any collections you create.

Select a record to open the record editor, where you can view and edit field values, including rich text content, files and relations.

Open Settings to configure the application name and URL, mail settings, file storage, scheduled backups and authentication providers.

Confirm PocketBase is running

Over SSH, confirm that the backend and the nginx proxy are active and that the ports are listening:

sudo systemctl is-active pocketbase nginx

sudo ss -tlnp | grep -E ':(80|8090) '

You should see both services reported as active, PocketBase listening on 127.0.0.1:8090 (loopback only), and nginx listening on port 80.

Check the health endpoint through the proxy. It needs no authentication and returns HTTP 200 with a small JSON body:

curl -fsS http://127.0.0.1/api/health

Create a collection

A collection is a database table with a schema, automatic REST endpoints and a rules-based authorization layer. Create collections from the dashboard with New collection. Give it a name and add fields (text, number, bool, select, relation, file, editor and more). Then set the API rules that control who can list, view, create, update and delete records.

As soon as you save, PocketBase exposes the collection at /api/collections/<name>/records.

The dashboard Import collections and Export collections screens round-trip the full schema as JSON. Use them to version-control the schema and promote it between environments.

Use the REST and realtime API

The REST and realtime API is served on the same port 80. The health endpoint is open. Everything else is governed by the collection API rules and authentication.

Authenticate as the superuser to obtain a token for administrative API calls. From your workstation, POST the superuser email and password as JSON:

curl -X POST http://<instance-public-ip>/api/collections/_superusers/auth-with-password \
  -H 'Content-Type: application/json' \
  -d '{"identity":"admin@sac.local","password":"<your-password>"}'

The response contains a token. Pass it in an Authorization header on subsequent requests, for example to list collections or read records.

For application end users, create a users-style auth collection. Authenticate against /api/collections/users/auth-with-password (or one of the configured OAuth2 providers) to obtain a per-user token.

PocketBase also exposes a realtime API over Server-Sent Events at /api/realtime. Clients subscribe to a collection or record and receive create, update and delete events as they happen. The bundled nginx proxy is configured with buffering disabled and a long read timeout, so the realtime stream works through port 80.

The data volume

The pb_data directory lives on a dedicated EBS volume mounted at /var/lib/pocketbase. This keeps the SQLite database and uploaded files off the operating system disk and lets you resize or snapshot them independently.

Confirm the mount with:

df -h /var/lib/pocketbase

To grow the data store, expand the EBS volume in the AWS console. Then grow the filesystem on the instance with sudo resize2fs on the underlying device.

The entire backend state (the database, files and migrations) lives under this mount.

Enable HTTPS

nginx serves the dashboard and API over plain HTTP on port 80. For production, place them behind TLS.

Obtain a certificate for your domain, for example a managed certificate on an Application Load Balancer in front of the instance, or Certbot installed on the instance. Then configure nginx to listen on 443 with your certificate and proxy to 127.0.0.1:8090, exactly as the bundled site does for port 80. Restrict the security group so that ports 80 and 443 are reachable only from the networks that use the backend.

PocketBase can also terminate TLS itself when run with a public domain. The bundled deployment fronts it with nginx so that you can manage certificates and routing in one place.

Backup and maintenance

PocketBase has a built-in backups feature under Settings, then Backups, in the dashboard. It produces a downloadable archive of pb_data and can run on a schedule. You can also back up the whole backend by snapshotting the /var/lib/pocketbase EBS volume.

Apply operating system security updates with sudo apt-get update && sudo apt-get upgrade. Reboot when a new kernel is installed. PocketBase and nginx start automatically on boot.

To upgrade PocketBase, replace the binary at /opt/pocketbase/pocketbase with a newer release and restart the service with sudo systemctl restart pocketbase. PocketBase applies any pending database migrations automatically on start.

Support

This image is published and supported by SecureAnyCloud. Support covers deployment, collection and schema design, authentication and OAuth2 setup, API rules, file storage, realtime subscriptions, backups, TLS and tuning.

Contact SecureAnyCloud through the support channel listed on the AWS Marketplace listing.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on AWS

Launch PocketBase on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS