Layer 3 · self-hosting reality check
What it actually takes to self-host Keycloak
The docs say 512 MB. In practice you want 4 GB. Here is the honest version — real requirements, real monthly cost, what you will be maintaining, and the one thing that catches people out.
Usually reached from Auth0 alternatives, where Keycloak is one of the picks.
| RAM — documented minimum | 512 MB |
|---|---|
| RAM — what it really needs | 4 GB |
| CPU | 2 vCPU |
| Disk | Small — under 20 GB unless you retain events |
| Monthly cost | $24–40/mo plus a database, against Okta or Auth0 per-user pricing that becomes brutal above the free tier |
| Setup time | A day to stand up, a week to configure realms and flows correctly |
| How you install it | container plus PostgreSQL; the dev-mode command is emphatically not production |
| Ongoing maintenance | Moderate to high. It is enterprise software with an enterprise upgrade cadence and its own vocabulary. |
| Where it stops scaling | Very far — it runs national-scale deployments. The limit is your understanding of it, not the software. |
The thing that catches people out
Running `start-dev` in production is the classic mistake — it uses an embedded H2 database that vanishes on restart, taking every user, client and realm with it. You must run `start` with an external database, a configured hostname and TLS. People discover the difference after a container restart wipes their identity provider.
When not to self-host Keycloak
You want something simple. Keycloak is powerful and genuinely complex; Authentik or Zitadel do 80% of the job with a fraction of the concepts if you do not need SAML federation and fine-grained authorization.
Every guide here carries this section. A site that only ever tells you to self-host is selling something — the useful answer is sometimes no.
Other Layer 3 self-hosting guides
Common questions
- How much RAM does Keycloak actually need?
- 4 GB in practice. The documented minimum is 512 MB, which is the figure at which the process starts rather than the figure at which it works under real use. 2 vCPU alongside it.
- What does self-hosting Keycloak cost per month?
- $24–40/mo plus a database, against Okta or Auth0 per-user pricing that becomes brutal above the free tier This is commodity VPS pricing and excludes your time, which is the larger cost for most people — budget for moderate to high. It is enterprise software with an enterprise upgrade cadence and its own vocabulary.
- How long does it take to set up Keycloak?
- A day to stand up, a week to configure realms and flows correctly, via container plus PostgreSQL; the dev-mode command is emphatically not production.
- When should I NOT self-host Keycloak?
- You want something simple. Keycloak is powerful and genuinely complex; Authentik or Zitadel do 80% of the job with a fraction of the concepts if you do not need SAML federation and fine-grained authorization.
- What is the most common mistake when self-hosting Keycloak?
- Running `start-dev` in production is the classic mistake — it uses an embedded H2 database that vanishes on restart, taking every user, client and realm with it. You must run `start` with an external database, a configured hostname and TLS. People discover the difference after a container restart wipes their identity provider.