Run OpenBSD on DigitalOcean for $4/month

Introduction

There's a certain satisfaction in running an operating system that hasn't had a remote hole in its default install in over two decades. OpenBSD, the Canadian-born UNIX derivative, has built its reputation on exactly that: a fanatical commitment to security, code correctness, and doing things the right way. For years, that reputation came with a trade-off—OpenBSD was something you ran on hardware you controlled, not on cloud platforms dominated by Linux images.

That's changing. DigitalOcean's $4/month droplet—512 MB RAM, 1 vCPU, 10 GB SSD, and 500 GB transfer—is cheap enough to experiment with, and OpenBSD 7.5 runs on it surprisingly well. The catch? DigitalOcean doesn't offer an official OpenBSD image, so you'll need to do a bit of work yourself.

This guide covers the latest OpenBSD developments, what you can actually do with a $4 droplet, two proven installation methods, post-install hardening, and practical use cases. By the end, you'll know exactly what it takes to get a secure, open-source OS running on one of the cheapest VPS plans in the cloud.

Latest OpenBSD Developments (2024)

OpenBSD 7.5 Release Highlights

OpenBSD 7.5 dropped on April 5, 2024, and it's a solid release. It supports 14 platforms, including amd64, arm64, and riscv64. Key additions include:

Improved hardware support for newer Intel and AMD processors
WireGuard improvements, including better performance and stability
New httpd features, including support for Server Name Indication (SNI) with multiple certificates
Enhanced pf (Packet Filter) capabilities, including better logging options
Various sysupgrade improvements—the built-in upgrade tool now handles more edge cases cleanly

Security Patches and the "Two Remote Holes" Record

OpenBSD's security page proudly states: "Only two remote holes in the default install, in more than 20 years." That record still holds. The project released several security advisories in 2024, covering issues in libtls, xterm, and the kernel—all patched promptly, all minor in scope. The ethos remains: audit everything, fix it before it becomes a problem, and never rush a release.

Key Takeaway: OpenBSD's security record isn't marketing. It's the result of a small, dedicated team that treats code auditing as a core feature, not an afterthought.

Community News

The OpenBSD community remains active. Notable 2024 projects include:

OpenBGPD and OpenOSPFd—ongoing work on the routing daemons, with better BGP performance
Ports tree growth—over 12,000 packages now available, including recent additions like nextcloud and syncthing
New hardware support—the arm64 port continues to expand, with support for more Rockchip and Raspberry Pi boards

DigitalOcean's $4 Droplet: Specs and Suitability

The $4/month "Basic" droplet gives you:

512 MB RAM
1 vCPU
10 GB SSD
500 GB transfer

That's not a lot, but it's enough for a surprising number of workloads. Here's what works well:

Light web servers—static sites, small dynamic apps, or a personal blog
VPN gateways—WireGuard uses minimal resources
Development environments—test OpenBSD-specific code or practice sysadmin skills
DNS servers—unbound runs comfortably in 512 MB
Load balancers—relayd can handle modest traffic

What to avoid:

Databases—PostgreSQL or MySQL will eat 512 MB alive
Heavy CMS workloads—WordPress with plugins will swap constantly
Anything requiring frequent disk writes—10 GB SSD fills up fast

Compared to other low-cost providers: Vultr and Linode offer similar specs at similar prices, but DigitalOcean's control panel and API are arguably the friendliest for custom image uploads. Hetzner is cheaper but doesn't have the same image-upload workflow.

Key Takeaway: The $4 droplet is a "starter" plan. Treat it as such—it's perfect for personal tools and small projects, not production workloads.

Installation Methods: Custom Images and Manual Setup

DigitalOcean doesn't provide OpenBSD images, and OpenBSD doesn't support cloud-init. You have two paths forward.

Method 1: Custom Image Upload (Recommended)

This is the cleaner approach. You create an OpenBSD disk image locally, upload it to DigitalOcean, and boot a droplet from it.

Step-by-step outline:

Create the image locally. Use qemu (on Linux or macOS) to create a raw disk image and install OpenBSD into it. A minimal install with no X11 is around 1 GB. Example command: bash qemu-img create -f raw openbsd.img 5G qemu-system-x86_64 -hda openbsd.img -cdrom install75.iso -m 512 -boot d
Install OpenBSD normally inside QEMU. Choose a simple partition layout: one root partition, swap optional.
Shrink the image to reduce upload size. Use qemu-img convert -O raw and then gzip it.
Upload to DigitalOcean. Go to your account's "Images" section, click "Custom Images," and upload the gzipped raw image.
Create a droplet from the custom image. Choose the $4 plan and your region.
Access via console. DigitalOcean's web console works for initial SSH key setup. Alternatively, use the API to inject your SSH public key during droplet creation.

Pitfalls: The image must be in raw format (not QCOW2). Ensure the root filesystem is not too large—DigitalOcean has a 10 GB disk limit on the $4 plan.

Method 2: ISO via Recovery Console

This method is more hands-on but requires no local image creation.

Boot a temporary Linux droplet (e.g., Ubuntu) on the $4 plan.
Download the OpenBSD ISO to the droplet: ftp https://cdn.openbsd.org/pub/OpenBSD/7.5/amd64/install75.iso
Mount the ISO and copy its contents to the droplet's disk or use it directly as a boot device.
Use DigitalOcean's recovery console to boot from the ISO and run the text installer.
During installation, you'll configure networking manually—DigitalOcean droplets use DHCP, so select that option.
After installation, reboot and remove the ISO.

Pitfalls: The recovery console is clunky—expect a slow, keyboard-only experience. You'll need to know OpenBSD's installer quirks (e.g., w for "whole disk" partitioning).

Key Takeaway: If you've never used OpenBSD's installer, Method 1 is safer. You can test everything locally before touching the cloud.

Post-Installation Configuration and Hardening

Once OpenBSD is booting, here's your first-hour checklist.

Initial Setup

# Create a regular user
useradd -m -G wheel username
passwd username

# Add your SSH public key
mkdir ~/.ssh && chmod 700 ~/.ssh
echo "ssh-rsa ..." > ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

# Disable root login over SSH
echo "PermitRootLogin no" >> /etc/ssh/sshd_config
rcctl restart sshd

Configuring PF Firewall

OpenBSD's pf is the default firewall. A minimal config for a web server:

# /etc/pf.conf
set skip on lo
block all
pass in on egress proto tcp to port { ssh, http, https }
pass out on egress

Apply with pfctl -f /etc/pf.conf.

Setting Up httpd

OpenBSD's built-in web server is simple and secure:

# /etc/httpd.conf
server "example.com" {
    listen on * port 80
    root "/htdocs/example.com"
}

Enable and start: rcctl enable httpd && rcctl start httpd.

Updates and Packages

OpenBSD's sysupgrade tool handles version upgrades:

sysupgrade

For packages:

pkg_add -u

Key Takeaway: OpenBSD's defaults are already conservative. Your job is to add more restrictions, not loosen them.

Practical Use Cases for a $4 OpenBSD Droplet

Personal VPN Gateway with WireGuard

WireGuard is now part of the OpenBSD base system. A VPN endpoint on a $4 droplet costs you almost nothing in resources. Configure /etc/hostname.wg0, generate keys with wg genkey, and you're done. This is one of the most popular uses for OpenBSD on cheap VPS instances.

Lightweight Web Server

A static site or a small Go/Rust binary runs fine in 512 MB. Use httpd with relayd if you need TLS termination or load balancing. The entire stack is in base—no need for nginx or Apache.

Development and Testing Environment

If you're writing software for OpenBSD, you need a real OpenBSD box. A $4 droplet is cheaper than buying a Raspberry Pi and more reliable than a local VM.

Load Balancing with relayd

relayd can forward HTTP, HTTPS, and TCP traffic to multiple backends. For a small service with two or three backend servers, it's a lightweight alternative to HAProxy.

Key Takeaway: The $4 droplet is a Swiss Army knife for personal infrastructure. Pick one job, do it well, and you'll never miss the extra resources.

Security Benefits and Comparisons

OpenBSD's security features are proactive, not reactive:

W^X—memory pages are either writable or executable, never both
ASLR—address space layout randomization is enabled by default
Stack protector—compiler-level buffer overflow protection
pledge() and unveil()—system calls that let programs restrict their own capabilities
Continuous code auditing—every line of base system code is reviewed regularly

Compared to Linux distributions, OpenBSD is less featureful but more predictable. There's no systemd, no SELinux, no AppArmor. Instead, you get a small, audited codebase where the attack surface is minimal by design.

Common misconception: "OpenBSD can't run in the cloud." False. It runs fine under KVM, which is what DigitalOcean uses. The lack of official images is a convenience issue, not a compatibility one.

Key Takeaway: If you want a system that's boring by design and secure by default, OpenBSD is hard to beat. It won't do everything Linux does, but what it does, it does thoroughly.

Community Resources and Support

Official documentation: The OpenBSD FAQ (https://www.openbsd.org/faq/) is comprehensive and well-written. Start with FAQ 4 (installation) and FAQ 6 (networking).
Mailing lists: [email protected] is active and welcoming to newcomers. Search archives before asking.
DigitalOcean community: Their tutorials on custom images apply to OpenBSD with minor tweaks. Search "custom image OpenBSD" for user-contributed guides.
Third-party blogs: Sites like "OpenBSD Journal" (undeadly.org) and "Ed Maste's blog" cover development and usage tips.

Key Takeaway: The OpenBSD community is small but knowledgeable. If you're stuck, ask on the mailing list—you'll get an answer, often within hours.

FAQ

Can I run OpenBSD on DigitalOcean's $4/month plan? Yes. The specs are sufficient for lightweight workloads. You'll need to upload a custom image or install manually.

How do I install OpenBSD on DigitalOcean? Two methods: create a custom image with QEMU and upload it, or boot from an ISO via the recovery console. Both are covered above.

Is OpenBSD supported by DigitalOcean's cloud-init? No. OpenBSD does not support cloud-init. You must configure networking and SSH manually during installation.

What are the limitations of the $4/month droplet? 512 MB RAM, 10 GB disk, and 500 GB transfer. Avoid databases, heavy CMS workloads, and anything that needs sustained disk I/O.

Can I use OpenBSD's PF firewall on DigitalOcean? Absolutely. PF is fully functional on the droplet. It's your first line of defense.

Does OpenBSD support IPv6 on DigitalOcean? Yes. When configuring networking, assign the IPv6 address provided by DigitalOcean and add it to /etc/hostname.vio0.

How do I update OpenBSD on my droplet? Use sysupgrade for version upgrades and pkg_add -u for package updates.

Is OpenBSD a good choice for a web server on a $4 droplet? Yes, for static sites or small dynamic apps. httpd is fast, secure, and uses minimal memory.

Can I use OpenBSD's httpd (built-in web server) on DigitalOcean? Yes. It's in the base system and works out of the box after configuration.

What are the security benefits of OpenBSD compared to Linux? Proactive features like W^X, ASLR, pledge(), unveil(), and a two-decade track record of only two remote holes in the default install.

Conclusion and Future Outlook

Running OpenBSD on a $4 DigitalOcean droplet is not just possible—it's a genuinely good idea for anyone who values security, simplicity, and low cost. The installation requires a bit of effort the first time, but once it's running, the system takes care of itself. Updates are painless, the firewall is robust, and the resource footprint is tiny.

Looking ahead, OpenBSD 7.6 is expected in October 2024. Cloud integration isn't a stated priority, but the KVM support is solid, and the custom image workflow is mature enough for production use. As more users adopt OpenBSD in the cloud, expect community tooling to improve—even if the project itself never ships a cloud-init shim.

The barrier to entry has never been lower. A $4 droplet, an hour of your time, and you've got a secure, audited, open-source operating system that respects your privacy and doesn't phone home.

Ready to secure your own $4 droplet with OpenBSD? Start by trying the custom image method and share your experience in the comments below. For more guides, subscribe to our newsletter!

In This Article