There's a certain satisfaction in running an operating system that hasn't had a remote hole in its default install in over two decades. OpenBSD, the Canadian-born UNIX derivative, has built its reputation on exactly that: a fanatical commitment to security, code correctness, and doing things the right way. For years, that reputation came with a trade-off—OpenBSD was something you ran on hardware you controlled, not on cloud platforms dominated by Linux images.
That's changing. DigitalOcean's $4/month droplet—512 MB RAM, 1 vCPU, 10 GB SSD, and 500 GB transfer—is cheap enough to experiment with, and OpenBSD 7.5 runs on it surprisingly well. The catch? DigitalOcean doesn't offer an official OpenBSD image, so you'll need to do a bit of work yourself.
This guide covers the latest OpenBSD developments, what you can actually do with a $4 droplet, two proven installation methods, post-install hardening, and practical use cases. By the end, you'll know exactly what it takes to get a secure, open-source OS running on one of the cheapest VPS plans in the cloud.
OpenBSD 7.5 dropped on April 5, 2024, and it's a solid release. It supports 14 platforms, including amd64, arm64, and riscv64. Key additions include:
httpd features, including support for Server Name Indication (SNI) with multiple certificatespf (Packet Filter) capabilities, including better logging optionssysupgrade improvements—the built-in upgrade tool now handles more edge cases cleanlyOpenBSD's security page proudly states: "Only two remote holes in the default install, in more than 20 years." That record still holds. The project released several security advisories in 2024, covering issues in libtls, xterm, and the kernel—all patched promptly, all minor in scope. The ethos remains: audit everything, fix it before it becomes a problem, and never rush a release.
Key Takeaway: OpenBSD's security record isn't marketing. It's the result of a small, dedicated team that treats code auditing as a core feature, not an afterthought.
The OpenBSD community remains active. Notable 2024 projects include:
nextcloud and syncthingThe $4/month "Basic" droplet gives you:
That's not a lot, but it's enough for a surprising number of workloads. Here's what works well:
unbound runs comfortably in 512 MBrelayd can handle modest trafficWhat to avoid:
Compared to other low-cost providers: Vultr and Linode offer similar specs at similar prices, but DigitalOcean's control panel and API are arguably the friendliest for custom image uploads. Hetzner is cheaper but doesn't have the same image-upload workflow.
Key Takeaway: The $4 droplet is a "starter" plan. Treat it as such—it's perfect for personal tools and small projects, not production workloads.
DigitalOcean doesn't provide OpenBSD images, and OpenBSD doesn't support cloud-init. You have two paths forward.
This is the cleaner approach. You create an OpenBSD disk image locally, upload it to DigitalOcean, and boot a droplet from it.
Step-by-step outline:
qemu (on Linux or macOS) to create a raw disk image and install OpenBSD into it. A minimal install with no X11 is around 1 GB. Example command:
bash
qemu-img create -f raw openbsd.img 5G
qemu-system-x86_64 -hda openbsd.img -cdrom install75.iso -m 512 -boot dqemu-img convert -O raw and then gzip it.Pitfalls: The image must be in raw format (not QCOW2). Ensure the root filesystem is not too large—DigitalOcean has a 10 GB disk limit on the $4 plan.
This method is more hands-on but requires no local image creation.
ftp https://cdn.openbsd.org/pub/OpenBSD/7.5/amd64/install75.isoPitfalls: The recovery console is clunky—expect a slow, keyboard-only experience. You'll need to know OpenBSD's installer quirks (e.g., w for "whole disk" partitioning).
Key Takeaway: If you've never used OpenBSD's installer, Method 1 is safer. You can test everything locally before touching the cloud.
Once OpenBSD is booting, here's your first-hour checklist.
# Create a regular user
useradd -m -G wheel username
passwd username
# Add your SSH public key
mkdir ~/.ssh && chmod 700 ~/.ssh
echo "ssh-rsa ..." > ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys
# Disable root login over SSH
echo "PermitRootLogin no" >> /etc/ssh/sshd_config
rcctl restart sshd
OpenBSD's pf is the default firewall. A minimal config for a web server:
# /etc/pf.conf
set skip on lo
block all
pass in on egress proto tcp to port { ssh, http, https }
pass out on egress
Apply with pfctl -f /etc/pf.conf.
OpenBSD's built-in web server is simple and secure:
# /etc/httpd.conf
server "example.com" {
listen on * port 80
root "/htdocs/example.com"
}
Enable and start: rcctl enable httpd && rcctl start httpd.
OpenBSD's sysupgrade tool handles version upgrades:
sysupgrade
For packages:
pkg_add -u
Key Takeaway: OpenBSD's defaults are already conservative. Your job is to add more restrictions, not loosen them.
WireGuard is now part of the OpenBSD base system. A VPN endpoint on a $4 droplet costs you almost nothing in resources. Configure /etc/hostname.wg0, generate keys with wg genkey, and you're done. This is one of the most popular uses for OpenBSD on cheap VPS instances.
A static site or a small Go/Rust binary runs fine in 512 MB. Use httpd with relayd if you need TLS termination or load balancing. The entire stack is in base—no need for nginx or Apache.
If you're writing software for OpenBSD, you need a real OpenBSD box. A $4 droplet is cheaper than buying a Raspberry Pi and more reliable than a local VM.
relayd can forward HTTP, HTTPS, and TCP traffic to multiple backends. For a small service with two or three backend servers, it's a lightweight alternative to HAProxy.
Key Takeaway: The $4 droplet is a Swiss Army knife for personal infrastructure. Pick one job, do it well, and you'll never miss the extra resources.
OpenBSD's security features are proactive, not reactive:
pledge() and unveil()—system calls that let programs restrict their own capabilitiesCompared to Linux distributions, OpenBSD is less featureful but more predictable. There's no systemd, no SELinux, no AppArmor. Instead, you get a small, audited codebase where the attack surface is minimal by design.
Common misconception: "OpenBSD can't run in the cloud." False. It runs fine under KVM, which is what DigitalOcean uses. The lack of official images is a convenience issue, not a compatibility one.
Key Takeaway: If you want a system that's boring by design and secure by default, OpenBSD is hard to beat. It won't do everything Linux does, but what it does, it does thoroughly.
[email protected] is active and welcoming to newcomers. Search archives before asking.Key Takeaway: The OpenBSD community is small but knowledgeable. If you're stuck, ask on the mailing list—you'll get an answer, often within hours.
Can I run OpenBSD on DigitalOcean's $4/month plan? Yes. The specs are sufficient for lightweight workloads. You'll need to upload a custom image or install manually.
How do I install OpenBSD on DigitalOcean? Two methods: create a custom image with QEMU and upload it, or boot from an ISO via the recovery console. Both are covered above.
Is OpenBSD supported by DigitalOcean's cloud-init? No. OpenBSD does not support cloud-init. You must configure networking and SSH manually during installation.
What are the limitations of the $4/month droplet? 512 MB RAM, 10 GB disk, and 500 GB transfer. Avoid databases, heavy CMS workloads, and anything that needs sustained disk I/O.
Can I use OpenBSD's PF firewall on DigitalOcean? Absolutely. PF is fully functional on the droplet. It's your first line of defense.
Does OpenBSD support IPv6 on DigitalOcean?
Yes. When configuring networking, assign the IPv6 address provided by DigitalOcean and add it to /etc/hostname.vio0.
How do I update OpenBSD on my droplet?
Use sysupgrade for version upgrades and pkg_add -u for package updates.
Is OpenBSD a good choice for a web server on a $4 droplet?
Yes, for static sites or small dynamic apps. httpd is fast, secure, and uses minimal memory.
Can I use OpenBSD's httpd (built-in web server) on DigitalOcean? Yes. It's in the base system and works out of the box after configuration.
What are the security benefits of OpenBSD compared to Linux?
Proactive features like W^X, ASLR, pledge(), unveil(), and a two-decade track record of only two remote holes in the default install.
Running OpenBSD on a $4 DigitalOcean droplet is not just possible—it's a genuinely good idea for anyone who values security, simplicity, and low cost. The installation requires a bit of effort the first time, but once it's running, the system takes care of itself. Updates are painless, the firewall is robust, and the resource footprint is tiny.
Looking ahead, OpenBSD 7.6 is expected in October 2024. Cloud integration isn't a stated priority, but the KVM support is solid, and the custom image workflow is mature enough for production use. As more users adopt OpenBSD in the cloud, expect community tooling to improve—even if the project itself never ships a cloud-init shim.
The barrier to entry has never been lower. A $4 droplet, an hour of your time, and you've got a secure, audited, open-source operating system that respects your privacy and doesn't phone home.
Ready to secure your own $4 droplet with OpenBSD? Start by trying the custom image method and share your experience in the comments below. For more guides, subscribe to our newsletter!