The standard deployment spans 9 named service images
Bitwarden Server supplies the backend for the official client family. The repository is mainly C# on ASP.NET Core, with T-SQL and SQL Server for the standard database path. Its README lists production image hashes for 9 services: Admin, API, Billing, Events, EventsProcessor, Identity, Notifications, SCIM, and SSO. That division makes sense for an established hosted product, but it is more infrastructure than the word server may suggest.
Administrators can choose standard Linux or Windows scripts, manual and offline installs, or Kubernetes with Helm. Bitwarden Lite, renamed from Unified after leaving beta in December 2025, packages a smaller deployment into 1 container for personal use and home labs. The standard paths remain the better documented choice for organizations that want the official service split and can manage several containers as one security-sensitive system.
Standard Linux starts at 2 GB RAM and 12 GB storage
The Linux guide sets a minimum of an x64 1.4 GHz processor, 2 GB RAM, and 12 GB storage. It recommends a 2 GHz dual-core processor, 4 GB RAM, and 25 GB storage. Docker Engine 26 or newer and the Compose plugin are required. Those are reasonable server numbers, though they rule out the smallest hobby VPS plans before vault attachments, database growth, logs, and backups consume more space.
Networking has a firm shape as well. Bitwarden requires 2 open traffic ports, one for HTTP and one for HTTPS, using 80 and 443 by default. The installation wizard expects a domain, certificate choice, installation ID, and installation key. Standard deployments ship with MSSQL Express; every official deployment except Lite documents external MSSQL 2019 or newer as the alternative. A team standardized on PostgreSQL should assess Lite separately rather than assume the standard compose stack can swap databases.
What happened when we ran it
Our sandbox work was deliberately limited to the npm project at src/Admin. At commit 92fffd5, npm installed 168 packages in 16 seconds and added 60 MB on disk. The Admin webpack build succeeded in 17 seconds in a fresh unprivileged Node 22 container with 3 CPUs and 8 GB of RAM. This proves the administration front end can compile in that environment; it says nothing about compiling the C# services or starting a usable vault.
The Admin package had no test script or target, so our harness skipped tests rather than reporting a pass. Npm audit found 0 known vulnerabilities: 0 critical, 0 high, 0 moderate, and 0 low. The whole checkout was much larger than the measured subproject, with 7,650 files, about 1,921,561 source lines, and 86.6 MB before installation. Our scan found 17 CI workflow files, a Dockerfile, and a tests directory.
Development needs .NET 10, Rust, MSSQL, and PowerShell
The current contributor guide lists the .NET 10 SDK, stable Rust, PowerShell, Docker Desktop, Visual Studio 2022, and a database management tool. A basic setup needs the API and Identity services. Docker Compose starts MSSQL and MailCatcher for most community work, while Redis and Azurite cover optional caching and Azure-compatible storage paths. This is a service development environment, not an npm application with one start command.
Configuration begins with a dev/.env file and an MSSQL password with at least 8 characters drawn from 3 of 4 character categories. A separate secrets file receives the database connection, an installation ID and key, and a license directory. The helper then installs those settings across server projects. Developers run a PowerShell migration script to create vault_dev, and the guide says to rerun it regularly as the main branch changes. Changing the MSSQL password after first startup requires recreating the database volume.
AGPL 3.0 covers the main server; enterprise code has separate terms
The repository's default license is AGPL 3.0, while files under the top-level /bitwarden_license directory use Bitwarden License 1.0. The license FAQ describes that second license as source available rather than open source under the OSI definition. It permits internal development and testing, but production use of those modules or environments supporting production requires a paid Bitwarden subscription. Trademark rights are separate from both code licenses.
The split affects builds as well as legal review. The FAQ says the API includes Commercial.Core by default, even though that module uses the Bitwarden License. Builders who want the AGPL-only server can disable it with the documented OSS compile constant. Organizations adopting SSO and other enterprise-oriented modules should price the subscription and record which image contains which license before treating a public source tree as permission for every production feature.
Version 2026.8.2 arrived 2 days before this review
Bitwarden published server v2026.8.2 on September 8, 2026, with a route-parameter bug fix, and GitHub recorded another push on September 10. The repository had 20,109 stars that day. Issue search separated the open queue into 34 issues and 194 pull requests, matching the 228 combined items in repository metadata. Several pull requests were created or updated on September 10, which is clear evidence of current company and contributor work.
Active maintenance does not remove upgrade risk. Open issue 7273 documents one self-hoster's MSSQL container repeatedly restarting during its 2026.3.0 database upgrade; the report had 99 comments and was updated on September 8. That issue does not establish a fault in v2026.8.2, but it is a useful rehearsal scenario. Before an upgrade, operators should verify database backups and a restore path on the exact deployment form they run.
Bitwarden Lite is the first trial for a personal server
For contributors, our 168-package Admin install and 17-second build are encouraging but narrow. The absent Admin test target and unmeasured .NET services prevent a clean whole-server verdict from this sandbox run. For buyers, the stronger evidence is operational: 2 required ports, a 12 GB minimum, MSSQL in the standard stack, and mixed license terms. Accept those deliberately and Bitwarden Server is the official self-hosted choice; ignore them and the password vault becomes another fragile service to protect.