PocketBase

What PocketBase does

PocketBase packs a complete small backend into one executable. You download a binary, run pocketbase serve, and get an SQLite database, a REST-style API, realtime subscriptions, user accounts, file uploads and an admin dashboard where you define collections and edit records. With a domain name it also obtains a Let’s Encrypt certificate on its own.

There are two ways to use it. The prebuilt binaries include a JavaScript engine, so you can add routes, event hooks, scheduled jobs and migrations in JavaScript files next to the binary. Or you can import PocketBase as a Go library and compile your own logic into a single custom executable. There are no cloud functions in the Firebase sense; custom code runs inside the same process.

Security and access control

Each collection has five API rules: list, view, create, update and delete. Auth collections get a sixth rule that lets one user manage another’s account. A rule is a filter expression that can refer to the record’s fields, to the incoming request (including the signed-in user, headers and body) and to other collections. Rules default to “locked”, meaning only superusers can perform the action, which is a safe starting point. Rules also filter results, so a list request returns only the records the user may see.

Sign-in options are password (with email or another unique field as the identity), email one-time codes and more than 15 OAuth2 providers, with optional multi-factor authentication that requires two different methods. Tokens are stateless and not stored on the server. Files are public by default behind a random filename suffix, and can be marked protected so they need a short-lived token and must pass the collection’s view rule.

Self-hosting PocketBase

There is nothing else to install: binaries are published for Linux, macOS, Windows and FreeBSD, and all data lives in a pb_data directory. The production guide shows a systemd service and reverse proxy configuration, and gives an example Dockerfile, though there is no official image. It strongly recommends setting up an SMTP server, turning on the built-in rate limiter and restricting superuser access to known IP addresses. Backups can be made from the dashboard to local disk or S3-compatible storage. The FAQ suggests Litestream if you need replication.

PocketBase scales only vertically, on one server. The FAQ says a small 2 vCPU, 4 GB VPS can hold more than 10,000 persistent realtime connections, and positions the tool for small and mid-sized apps.

Hosted version

There is none. The FAQ states PocketBase is self-hosted only.

Limitations

The project is still before version 1.0, and the README warns that full backward compatibility is not guaranteed, so read release notes before upgrading. It is a personal project developed by one volunteer, with no company, paid support or maintenance promises behind it. SQLite is the only database and there is no built-in import from Firebase or other services. Pull requests are currently limited to existing collaborators.

Who it suits

PocketBase is a strong choice for prototypes, internal tools, side projects and small to mid-sized production apps that fit on one server, especially when you want to deploy a single file. Teams that need horizontal scaling, a hosted option or vendor support should look at Supabase or Appwrite; for a similar single-binary design with more built-in runtimes, see TrailBase.