DPTCloud
Back to articles
Technology Insight

Self-Hosting Penpot on ARM64 VPS: Overcoming Architecture Compatibility Challenges for an Independent UI/UX Platform

June 3, 2026

Introduction: The Rise of Open-Source UI/UX and the ARM64 Advantage

In the modern software development lifecycle, the UI/UX design toolchain has traditionally been dominated by proprietary, cloud-only platforms. While these tools offer robust features, they often introduce vendor lock-in, unpredictable pricing tiers, and data privacy concerns. Enter Penpot, the pioneering open-source, web-based design and prototyping platform that bridges the gap between designers and developers using open standards like SVG.

Simultaneously, the cloud infrastructure landscape has shifted dramatically with the mainstream adoption of ARM64 architecture (such as AWS Graviton, Ampere Altra, and Oracle Cloud Infrastructure's A1 instances). ARM64 virtual private servers (VPS) deliver exceptional price-to-performance ratios, often cutting compute costs by up to 40% compared to traditional x86_64 alternatives. However, marrying cutting-edge open-source design software with cost-effective ARM64 architecture introduces unique technical hurdles. This guide provides a comprehensive roadmap to self-hosting Penpot on an ARM64 VPS, focusing on diagnosing and resolving architecture compatibility layers, Docker configurations, and backend environment alignment.

---

Understanding the ARM64 Compatibility Challenge with Penpot

Before diving into the deployment phase, it is vital to understand why a standard docker-compose up might fail on an ARM64 system. Penpot is built on a highly performant, distributed stack consisting of several core components:

  • Penpot Frontend: A compiled ClojureScript single-page application served via Nginx.
  • Penpot Backend: A Clojure application running on the Java Virtual Machine (JVM) handling business logic.
  • Penpot Exporter: A Node.js application utilizing a headless browser (Chromium) to render and export assets to PDF, PNG, and SVG.
  • Database & Storage: PostgreSQL for relational data and Redis for state/session management.

The primary architectural bottleneck almost always lies within the Penpot Exporter. Because the exporter relies on headless Chromium to execute complex vector rendering, the underlying Docker image must contain a compiled binary of Chromium that matches the host's ARM64 CPU instructions. If the Docker registry pulls an x86_64 image by default, the emulation layer (such as QEMU) will trigger massive performance degradation or fail entirely with a cryptic SIGSEGV or Exec format error. Understanding this multi-architecture landscape is the key to a seamless installation.

---

Prerequisites and Environment Preparation

To ensure a stable deployment, your infrastructure should meet the following minimum requirements:

  • Compute: An ARM64 VPS with at least 2 vCPUs and 4GB of RAM (Penpot's backend JVM and headless browser are memory-intensive during peak export operations).
  • Operating System: Ubuntu 22.04 LTS or Debian 12 optimized for ARM64.
  • Software: Docker Engine (v24.0 or higher) and Docker Compose (v2.0 or higher) natively installed for ARM64.
  • Networking: A fully qualified domain name (FQDN) pointing to your VPS IP address, with ports 80 and 443 open.
Note: Avoid using minimal micro-instances with less than 2GB of RAM. The initialization phase of the Clojure runtime combined with database migrations will likely trigger the Linux Out-Of-Memory (OOM) killer.
---

Step-by-Step Deployment Guide on ARM64

Step 1: Fetching the Official Multi-Arch Configuration

Fortunately, the Penpot maintainers have made significant strides in supporting multi-architecture builds. We begin by downloading the official Docker Compose configuration manifest. Execute the following commands in your terminal:

mkdir -p /opt/penpot && cd /opt/penpot
wget [https://raw.githubusercontent.com/penpot/penpot/main/docker/images/docker-compose.yaml](https://raw.githubusercontent.com/penpot/penpot/main/docker/images/docker-compose.yaml)

Step 2: Inspecting and Editing the Environment Variables

Open the downloaded docker-compose.yaml file or create an accompanying .env file to customize your deployment. Pay close attention to the image tags. We must ensure that the images pulled support the linux/arm64 platform natively.

Verify that your configuration specifies stable tags rather than outdated specific releases that may lack ARM64 binaries:

services:
  penpot-frontend:
    image: penpotapp/frontend:latest
  penpot-backend:
    image: penpotapp/backend:latest
  penpot-exporter:
    image: penpotapp/exporter:latest

Next, generate secure credentials for your database and encryption keys. Modify the environment block to include:

PENPOT_SECRET_KEY=your_random_very_long_secret_key
PENPOT_DATABASE_URI=postgresql://penpot:secure_password@penpot-postgres/penpot
PENPOT_REDIS_URI=redis://penpot-redis:6379/0

Step 3: Resolving the Headless Chromium ARM64 Bottleneck

If you encounter rendering errors during asset exports, the default bundled Chromium inside the penpotapp/exporter image may be conflicting with local ARM64 kernel memory allocations. To bypass this, we can instruct the exporter to utilize a natively compiled system binary by adding specific flags to the backend or exporter environmental variables:# Inside the penpot-exporter environment definition PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium-browser

This forces Node.js to use the optimized, native ARM64 Debian/Ubuntu package variant of Chromium instead of downloading an incompatible generic binary during container runtime initialization.

---

Advanced Optimization: Database and JVM Tuning for ARM64

ARM64 cores handle multi-threading efficiently, but memory access patterns differ from traditional x86 architectures. To extract maximum performance from your Penpot instance, apply these platform-specific adjustments:

PostgreSQL Configuration

Since Penpot relies heavily on complex JSON and vector path storage within PostgreSQL, modify your database container's runtime parameters inside the compose file to leverage ARM64 memory structures:

command: ["postgres", "-c", "shared_buffers=1GB", "-c", "work_mem=32MB", "-c", "effective_cache_size=3GB"]

Java Virtual Machine (JVM) Configuration

The Penpot backend runs on Clojure via the JVM. Modern JVMs are highly optimized for ARM64 (AArch64), featuring advanced garbage collection mechanics. You can pass explicit flags via the JAVA_OPTS environment variable in the penpot-backend service:JAVA_OPTS: "-XX:+UseG1GC -XX:+UseStringDeduplication -Xms1g -Xmx2g"

The -XX:+UseStringDeduplication flag is particularly effective for Penpot, as design files often contain highly repetitive string data representing SVG paths, saving up to 20% of heap memory allocation.

---

Configuring a Reverse Proxy with SSL (Nginx & Let's Encrypt)

Running Penpot directly on port 80 is insecure and exposes the internal application layers to potential exploits. Deploying an upstream reverse proxy like Nginx ensures that all data, including sensitive design intellectual property, is encrypted in transit via TLS.

Create an Nginx server block configuration pointing to your Penpot frontend container:

server {
    listen 80;
    server_name design.yourdomain.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name design.yourdomain.com;

    ssl_certificate /etc/letsencrypt/live/[design.yourdomain.com/fullchain.pem](https://design.yourdomain.com/fullchain.pem);
    ssl_certificate_key /etc/letsencrypt/live/[design.yourdomain.com/privkey.pem](https://design.yourdomain.com/privkey.pem);

    client_max_body_size 100M; # Crucial for large asset and image uploads

    location / {
        proxy_pass http://localhost:6060;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Execute sudo certbot --nginx -d design.yourdomain.com to automatically request and install your free Let's Encrypt SSL certificate.

---

Verifying the Installation and Troubleshooting

With all configurations finalized, initialize your stack using the detached flag:

docker compose up -d

Monitor the initialization logs to ensure there are no architecture-related segmentation faults:

docker compose logs -f --tail=100

If you see a successful backend migration log message and no crash loops from the exporter, navigate to your domain name in a web browser. You will be greeted by the Penpot registration screen. To create your first administrative user natively via the CLI, execute:

docker compose exec penpot-backend python3 manage.py create-user

Common Troubleshooting Scenarios

  • Symptom: Exporter container keeps restarting with code 139.
    Solution: This indicates a memory alignment or emulation mismatch. Ensure you are not running an x86 image through QEMU. Explicitly clear your Docker cache with docker builder prune -a and pull the explicit arm64 variant.
  • Symptom: Large image uploads fail with HTTP 413.
    Solution: Your reverse proxy configuration is blocking the payload. Ensure client_max_body_size 100M; is explicitly defined in your Nginx HTTP or Server configuration context.
---

Conclusion

Self-hosting Penpot on an ARM64 architecture represents the perfect intersection of modern open-source product design and cost-efficient cloud engineering. By systematically addressing the architectural differences inherent in headless browser automation and tuning the underlying JVM and database runtimes, engineers can deploy a fluid, collaborative UI/UX environment that rivals proprietary alternatives at a fraction of the operating cost. Take ownership of your design system, secure your data, and enjoy the performance benefits of a tailored ARM64 deployment.

Self-Hosting Penpot on ARM64 VPS: Overcoming Architecture Compatibility Challenges for an Independent UI/UX Platform | DPTCloud