DigitalOcean Droplets: Choosing a Plan, Region and First Setup

DigitalOcean Droplets are Linux virtual machines that you can create in under a minute from a web console, the doctl command line tool or the API. This guide walks through the decisions that matter before you click “Create”: which plan family fits your workload, which region to pick, and what to configure in the first hour so the server is secure and recoverable.

What a Droplet actually is #

A Droplet is a KVM-based virtual machine with a fixed allocation of vCPU, memory, local SSD storage and an outbound transfer allowance. You choose an operating system image (Ubuntu, Debian, Fedora, Rocky Linux, AlmaLinux and others), a one-click Marketplace image, or one of your own snapshots or custom images.

Each Droplet gets a public IPv4 address, optional IPv6, and a private address inside a VPC network in its region. Everything else, such as extra block storage, load balancers, managed databases and firewalls, is a separate product that you attach as needed. For a wider view of the platform, see our DigitalOcean platform overview.

Choosing a plan family #

DigitalOcean groups Droplet sizes into families. The names have changed over the years, so always check the current list in the control panel, but the underlying split is between shared and dedicated CPU.

Shared vs dedicated CPU

Basic Droplets share physical CPU cores with other tenants. For most small workloads this is fine, because CPU usage is bursty and rarely pinned at 100 percent. If your application runs sustained CPU load, such as compiling code or encoding video all day, shared CPU can produce inconsistent performance.

Dedicated CPU plans reserve hyperthreads for your Droplet. You pay more per vCPU, but performance is predictable. A reasonable approach is to start on Basic, watch CPU steal and load in the monitoring graphs, and move up only when the data says you need to.

Regular vs Premium within Basic

Within the Basic family, Premium options use newer Intel or AMD processors and NVMe storage. For latency-sensitive web apps or anything disk-heavy, the Premium tiers are often worth the small step up. For a simple static site or a hobby bot, Regular is usually enough.

Sizing without guessing

• Start from memory. Most small web stacks run out of RAM before CPU. Add up your application process, database (if local), and a margin for the OS and caches.
• Remember disk is fixed per plan. If you expect data to grow, put it on a separate Volume (block storage) rather than relying on the Droplet’s local disk.
• Plan for resizing. A CPU and RAM only resize can be reversed later. A resize that increases disk size is permanent, because a disk cannot be shrunk.

Picking a region #

DigitalOcean runs datacenters in North America, Europe, Asia and Australia, including locations such as New York, San Francisco, Toronto, Amsterdam, London, Frankfurt, Singapore, Bangalore and Sydney. Not every Droplet size or product is available in every region, so check availability before you commit a design to one location.

Three questions narrow the choice quickly:

1. Where are your users? Latency to the end user usually matters more than anything else for web applications.
2. Where are your other resources? Private VPC traffic only works within a region. Keep your Droplets, managed databases and load balancers together.
3. Do you have data residency requirements? If customer data must stay in the EU, for example, choose Amsterdam, Frankfurt or London and keep backups in the same jurisdiction.

Moving a Droplet to another region later is possible by taking a snapshot, transferring it and creating a new Droplet from it, but the new Droplet gets a new IP address. Choosing well at the start saves DNS changes and downtime.

How Droplet billing works #

Droplets are billed on a usage basis up to a monthly cap for each size, so a server that runs all month costs the listed monthly price and a short-lived test server costs a fraction of it. Check the official pricing page for the current billing granularity and rates.

Backups, snapshots, Volumes, load balancers and extra outbound transfer beyond your pooled allowance are billed separately. Our guide to cloud cost management with budgets, tagging and right-sizing covers habits that keep a small account from drifting upward over time.

A sensible first setup #

The following order works well for a fresh Ubuntu or Debian Droplet. It assumes you are comfortable with SSH and a terminal.

1. Create it with an SSH key, not a password

Add your public key under Settings, Security before creating the Droplet, then select it on the create page. Key-based authentication removes the most common attack on new servers: automated password guessing against SSH.

2. Use user data for repeatable configuration

The create page accepts a cloud-init script under “Advanced options”. A short script that creates a non-root user, installs updates and sets the timezone means every new Droplet starts from the same baseline. It also documents what you did, which helps when you rebuild later.

3. Attach a Cloud Firewall

DigitalOcean Cloud Firewalls are applied at the network level before traffic reaches the Droplet, and they are free. A typical web server rule set:

• Inbound TCP 22 from your own IP address or office range only
• Inbound TCP 80 and 443 from all sources
• Inbound traffic from the VPC range for internal services
• Outbound: allow all, or restrict if you have a strict egress policy

Apply firewalls by tag rather than by individual Droplet. Any new Droplet with the tag web then inherits the right rules automatically.

4. Harden the operating system

• Create a sudo user and disable root login over SSH (PermitRootLogin no).
• Disable password authentication (PasswordAuthentication no).
• Enable unattended security updates.
• Optionally run a host firewall such as ufw as a second layer behind the Cloud Firewall.

5. Turn on backups and monitoring

Automated backups are a paid add-on priced as a percentage of the Droplet cost, with weekly and daily options. They protect against mistakes on the server itself. Snapshots are manual, point-in-time images, useful before risky upgrades.

Install the metrics agent (it can be selected at creation) to get memory and disk graphs alongside CPU, then set alert policies for high CPU, memory and disk usage so you hear about problems before users do.

6. Reserve an IP if the address must survive rebuilds

A Reserved IP is a static public address you can move between Droplets in the same region. Point DNS at the Reserved IP, and you can replace the underlying Droplet without waiting for DNS changes to propagate.

Sending email from a Droplet #

DigitalOcean restricts outbound SMTP traffic on many accounts by default. This is an anti-abuse measure: newly created virtual machines are a common source of spam, and blocking direct SMTP protects the reputation of DigitalOcean’s IP ranges for every customer.

The recommended approach is to send application email through a dedicated email delivery service or relay over its API or an authenticated submission port, rather than running your own mail server on a Droplet. These services handle IP reputation, bounce processing and authentication, which are hard to get right on a single VM. If you have a specific need, the correct route is DigitalOcean’s official support process, described in their documentation. Whatever you use, set up domain authentication: our guide to SPF, DKIM and DMARC for application senders explains the DNS records involved.

When a Droplet is not the right tool #

Droplets are general-purpose servers, which means you manage the OS, patches and scaling. Consider the alternatives when:

• You just want to deploy code. DigitalOcean App Platform builds and runs apps from a Git repository without server management.
• You need a production database. Managed Databases handle backups, failover and patching for PostgreSQL, MySQL and other engines.
• You run containers at scale. DigitalOcean Kubernetes provides a managed control plane with Droplets as worker nodes.

If you are still deciding whether a developer-focused provider suits your project, our comparison of hyperscalers vs developer clouds covers the trade-offs. Official product details are in the DigitalOcean documentation, including the Droplets product docs, and current rates are on the DigitalOcean pricing page.

DigitalOcean Droplets: frequently asked questions #

Can I change a Droplet’s plan after creating it?

Yes. You can resize a Droplet from the control panel after powering it off. A CPU and RAM only resize can be reversed later, but increasing the disk size is permanent because disks cannot be shrunk.

Am I charged for a Droplet that is turned off?

Yes. Powered-off Droplets still reserve disk, IP and compute capacity, so they continue to be billed. Destroy the Droplet (after taking a snapshot if you need the data) to stop charges.

What is the difference between backups and snapshots?

Backups are automatic, scheduled images billed as a percentage of the Droplet price. Snapshots are manual, on-demand images billed per GB stored, and they are useful before upgrades or for cloning a server.

Why can’t my Droplet send email over port 25?

DigitalOcean restricts outbound SMTP on many accounts to prevent spam from new servers. Use an email delivery service or relay for application mail, and contact DigitalOcean support through the official process if you have a specific requirement.