Layer 3 · self-hosting reality check
What it actually takes to self-host Keycloak
The docs say 512 MB. In practice you want 4 GB. Here is the honest version — real requirements, real monthly cost, what you will be maintaining, and the one thing that catches people out.
Usually reached from Auth0 alternatives, where Keycloak is one of the picks.
Wondering whether you need to at all? Is Auth0 free? — what the free tier actually allows, and where the wall is.
| RAM — documented minimum | 512 MB |
|---|---|
| RAM — what it really needs | 4 GB |
| CPU | 2 vCPU |
| Disk | Small — under 20 GB unless you retain events |
| Monthly cost | $24–40/mo plus a database, against Okta or Auth0 per-user pricing that becomes brutal above the free tier |
| Setup time | A day to stand up, a week to configure realms and flows correctly |
| How you install it | container plus PostgreSQL; the dev-mode command is emphatically not production |
| Ongoing maintenance | Moderate to high. It is enterprise software with an enterprise upgrade cadence and its own vocabulary. |
| Where it stops scaling | Very far — it runs national-scale deployments. The limit is your understanding of it, not the software. |
The thing that catches people out
Running `start-dev` in production is the classic mistake — it uses an embedded H2 database that vanishes on restart, taking every user, client and realm with it. You must run `start` with an external database, a configured hostname and TLS. People discover the difference after a container restart wipes their identity provider.
When not to self-host Keycloak
You want something simple. Keycloak is powerful and genuinely complex; Authentik or Zitadel do 80% of the job with a fraction of the concepts if you do not need SAML federation and fine-grained authorization.
Every guide here carries this section. A site that only ever tells you to self-host is selling something — the useful answer is sometimes no.
Other Layer 3 self-hosting guides
Common questions
- How much RAM does Keycloak actually need?
- 4 GB in practice. The documented minimum is 512 MB, which is the figure at which the process starts rather than the figure at which it works under real use. 2 vCPU alongside it.
- What does self-hosting Keycloak cost per month?
- $24–40/mo plus a database, against Okta or Auth0 per-user pricing that becomes brutal above the free tier This is commodity VPS pricing and excludes your time, which is the larger cost for most people — budget for moderate to high. It is enterprise software with an enterprise upgrade cadence and its own vocabulary.
- How long does it take to set up Keycloak?
- A day to stand up, a week to configure realms and flows correctly, via container plus PostgreSQL; the dev-mode command is emphatically not production.
- When should I NOT self-host Keycloak?
- You want something simple. Keycloak is powerful and genuinely complex; Authentik or Zitadel do 80% of the job with a fraction of the concepts if you do not need SAML federation and fine-grained authorization.
- What is the most common mistake when self-hosting Keycloak?
- Running `start-dev` in production is the classic mistake — it uses an embedded H2 database that vanishes on restart, taking every user, client and realm with it. You must run `start` with an external database, a configured hostname and TLS. People discover the difference after a container restart wipes their identity provider.