--- title: "Keycloak Docker Compose and one-click hosting" description: "Keycloak is open-source identity and access management: single sign-on, social login and two-factor auth. Self-host this Auth0 alternative in one click." --- [← All templates](https://pethost.dev/templates/) · [Passwords and sign-in](https://pethost.dev/templates/security/) # Deploy Keycloak in one click Open-source identity and access management: single sign-on for your apps with OpenID Connect and SAML A self-hosted alternative to Auth0 and Okta. [Deploy on Pethost](https://console.pethost.dev/?template=keycloak) ## What is Keycloak? Keycloak is an identity and access management server: your apps hand sign-in to it, and a person who has signed in once is signed in to all of them. It speaks OpenID Connect, OAuth 2.0 and SAML 2.0, so most apps and frameworks connect to it with their standard libraries. It signs people in with a password, a passkey or a social account such as Google or GitHub, adds two-factor authentication with one-time codes, syncs users from LDAP and Active Directory, and lets each user manage their profile, password and sessions in its account console. Keycloak is a Cloud Native Computing Foundation incubation project, used by companies and home labs alike to put one sign-in in front of many apps. This template runs it in production mode with PostgreSQL behind the proxy, and makes the administrator of the master realm from the fields before Keycloak answers anyone. The catch: Keycloak is powerful and has many settings, so a first client takes some reading, and it runs on Java, which takes more memory than most sign-in servers. ## Hosting Keycloak on Pethost 1. You sign in to Pethost with a passkey, GitHub or Google. No machine yet? You pick a plan, and the link waits until it is ready. 2. New project opens at Keycloak. You fill in what it asks for and click Create project: **Username**, **Admin password**. 3. In a minute or two Keycloak is live at its own address with HTTPS. Its secrets are made at random, and its data is in the nightly backup. 4. It is a project like any other: you or your agent can change it, roll it back or restore it. ## Questions about Keycloak **Is Keycloak free?** Yes. Keycloak is open source under the Apache 2.0 license, with no paid edition and no limit on users or apps. Red Hat sells support for its own build of it, the Red Hat build of Keycloak. **Keycloak vs Auth0: which should I use?** Both sign users in over OpenID Connect and SAML with social login and two-factor authentication. Auth0 is a cloud service priced by monthly active users, while Keycloak is one you run yourself, free for any number of users, at the cost of looking after it. **Can Keycloak sign users in with Google or GitHub?** Yes. Identity Providers in a realm adds Google, GitHub, Facebook, Microsoft and others, or any OpenID Connect or SAML 2.0 provider, as buttons on its sign-in page, with no change to your apps. **Does Keycloak support two-factor authentication and passkeys?** Yes. It takes one-time codes from apps such as Google Authenticator or FreeOTP, recovery codes and passkeys, and a realm can require them for everyone or let users turn them on in the account console. **Why does Keycloak say I am a temporary admin?** Keycloak marks the administrator it makes at its first start as temporary, and asks for a permanent one: add a user in the master realm, give it the admin role under Role mapping, sign in as it and delete the temporary admin. **How much memory and disk does Keycloak need?** Keycloak runs on Java: about 550 MB of memory with Postgres at rest, more with many users and sessions; its database stays small. On Pethost the Starter plan is enough for it, with room for other apps beside it. ## Keycloak Docker Compose file The template is this compose.yaml and the variables written into the project’s .env as it is created. Pethost runs the file as it is written. **Containers:** keycloak (quay.io/keycloak/keycloak:26.8), postgres (postgres:18-alpine). **Volumes, in the nightly backup:** db. ``` services: keycloak: image: quay.io/keycloak/keycloak:26.8 restart: unless-stopped command: start environment: KC_DB: postgres KC_DB_URL: jdbc:postgresql://postgres:5432/keycloak KC_DB_USERNAME: keycloak KC_DB_PASSWORD: ${POSTGRES_PASSWORD} KC_HOSTNAME: ${URL} # The proxy serves HTTPS and passes requests on over HTTP, saying in X-Forwarded-* who sent # them and how. KC_HTTP_ENABLED: "true" KC_PROXY_HEADERS: xforwarded KC_HEALTH_ENABLED: "true" # The administrator of the master realm is made from these at the first start, before # Keycloak answers anyone; Keycloak calls it temporary until a permanent one replaces it. KC_BOOTSTRAP_ADMIN_USERNAME: ${ADMIN_USERNAME} KC_BOOTSTRAP_ADMIN_PASSWORD: ${ADMIN_PASSWORD} depends_on: postgres: condition: service_healthy # The port listens before Keycloak is ready: the deploy waits for its readiness, which its # management port answers. The image has no curl: bash asks it. healthcheck: test: ["CMD-SHELL", "exec 3<>/dev/tcp/127.0.0.1/9000 && printf 'GET /health/ready HTTP/1.1\\r\\nHost: localhost\\r\\nConnection: close\\r\\n\\r\\n' >&3 && grep -q '\"UP\"' <&3"] interval: 5s timeout: 5s retries: 5 start_period: 180s postgres: image: postgres:18-alpine restart: unless-stopped environment: POSTGRES_DB: keycloak POSTGRES_USER: keycloak POSTGRES_PASSWORD: ${POSTGRES_PASSWORD} volumes: - db:/var/lib/postgresql healthcheck: test: ["CMD-SHELL", "pg_isready -h 127.0.0.1 -U keycloak -d keycloak"] interval: 5s timeout: 5s retries: 10 start_period: 30s volumes: db: ``` [compose.yaml](https://pethost.dev/templates/keycloak/compose.yaml)[See it on GitHub](https://github.com/pethost-dev/templates/tree/main/keycloak) ## [More in Passwords and sign-in](https://pethost.dev/templates/security/) - [**Vaultwarden**A password manager server for the Bitwarden apps](https://pethost.dev/templates/vaultwarden/) - [**Authorizer**Sign-in for your own apps, with OAuth 2 and OpenID Connect](https://pethost.dev/templates/authorizer/) - [**Password Pusher**Share passwords and secrets by links that expire](https://pethost.dev/templates/password-pusher/) - [**authentik**An identity provider for single sign-on to your apps: OpenID Connect, SAML, LDAP, MFA and passkeys](https://pethost.dev/templates/authentik/) - [**FusionAuth**Customer identity and access management: sign-in, registration, single sign-on and MFA for your apps](https://pethost.dev/templates/fusionauth/) Pethost · Stephan Gomer · NIP 1133096755 Pethost - [Templates](https://pethost.dev/templates/) - [About](https://pethost.dev/about/) - [Docs](https://pethost.dev/docs/) - [Blog](https://pethost.dev/blog/) - [API](https://pethost.dev/docs/api/) - [CLI](https://pethost.dev/docs/cli/) - [Plugin](https://github.com/pethost-dev/plugin) - [Terms](https://pethost.dev/terms/) - [Privacy](https://pethost.dev/privacy/) - [Refunds](https://pethost.dev/refunds/) - [support@pethost.dev](mailto:support@pethost.dev) Databases - [Postgres](https://pethost.dev/postgres/) Comparisons - [Coolify vs Dokploy vs CapRover vs Dokku](https://pethost.dev/blog/coolify-vs-dokploy-vs-caprover-vs-dokku/) - [Coolify Cloud vs Dokploy Cloud](https://pethost.dev/blog/coolify-cloud-vs-dokploy-cloud/) - [Railway vs Render vs Fly.io pricing](https://pethost.dev/blog/railway-vs-render-vs-fly-io-pricing/) - [Managed Docker Compose hosting](https://pethost.dev/blog/managed-docker-compose-hosting/) Alternatives - [Railway alternatives](https://pethost.dev/blog/railway-alternatives/) - [Heroku alternatives](https://pethost.dev/blog/heroku-alternatives/) - [Dokploy alternatives](https://pethost.dev/blog/dokploy-alternatives/) - [Coolify alternatives](https://pethost.dev/blog/coolify-alternatives/) - [Render alternatives](https://pethost.dev/blog/render-alternatives/) - [Sliplane alternatives](https://pethost.dev/blog/sliplane-alternatives/)