What this panel needs to run
The numbers below are measured, not estimated. They come from a server running the full stack — panel, admin, three web servers, MariaDB, PostgreSQL, BIND, Postfix, Dovecot, rspamd, ClamAV, a search engine and twelve PHP-FPM masters — and from what those processes actually hold in memory.
Supported operating systems
| Distribution | Versions |
|---|---|
| Ubuntu | 22.04, 24.04 |
| Debian | 11, 12 |
| AlmaLinux, Rocky, RHEL, Oracle Linux | 8 and above |
The installer refuses anything else rather than getting halfway and leaving a broken machine.
Minimums
There is no single number, because the panel installs services you may not want. Pick the row that matches what you will actually run.
| What you run | CPU | RAM | Disk |
|---|---|---|---|
| Panel, web server, MariaDB — websites only | 2 cores | 2 GB | 20 GB |
| The above plus mail with virus and spam scanning | 2 cores | 4 GB | 40 GB |
| Everything the installer offers, including a search engine | 4 cores | 8 GB | 60 GB |
Disk is for the system and the panel. Customer data is on top of it, and it is the number that grows.
Where the memory actually goes
Measured on a server carrying 5 accounts, 2 websites and 2 mailboxes — which is to say, almost nothing. 6.1 GB of 12 GB was in use:
| Service | Resident memory |
|---|---|
| Search engine (Java) | 2075 MB |
| ClamAV | 1952 MB |
| PHP-FPM masters | 1343 MB |
| rspamd | 753 MB |
| Amavis | 454 MB |
| SpamAssassin | 324 MB |
| The panel itself | 192 MB |
| BIND | 191 MB |
| MariaDB | 158 MB |
Two things worth reading off that table before you size a server:
The mail scanners cost more than everything else combined. ClamAV, rspamd, Amavis and SpamAssassin together are about 3.5 GB, and that is with two mailboxes. If you are not hosting mail, you do not need most of this machine.
The search engine is a JVM. It reserves its heap whether or not anything uses it. If no customer needs Elasticsearch or OpenSearch, leaving it out is the single largest saving available.
Swap
The installer creates a swap file of 2–4 GB when the machine has none, and leaves existing swap alone.
This is not a substitute for RAM. It is there because a machine with 2 GB and no swap gets through the install and then meets the OOM killer the first time a customer runs a WordPress import next to a database and a search engine — and what the OOM killer chooses to end is not usually the thing that caused it.
Ports
Reachable from the internet: 80, 443 (websites), 2083 (panel), 2087 (admin), 2096 (webmail), 8888 (phpMyAdmin), 53 (DNS), 25, 465, 587 (mail), 993, 995 (mailbox access), 21 and the passive range (FTP).
Loopback only, never exposed: 8188/8288, 8189/8289, 8190/8290 — nginx, Apache and OpenLiteSpeed behind the front end.
One thing that is not a requirement, and matters more than any of them
A PTR record for your server's IP, matching the name it announces. It is set by whoever owns the address range — your provider — and nothing on this server can set it for you. Without it a large share of your customers' mail will be treated as suspicious no matter how correct SPF, DKIM and DMARC are.
Ask for it before you migrate anybody.