Deploy an AI Agent on a DigitalOcean Droplet (2026)

Why People Keep Landing on DigitalOcean for AI Agents

If you have decided to self-host an AI agent, you eventually hit the same three-way pick: Hetzner, AWS EC2, or DigitalOcean. Each attracts a different crowd. Hetzner attracts the EU cost-optimizer. AWS attracts the "our company already uses it" crowd. DigitalOcean attracts the indie SaaS builder who wants a plain Ubuntu box, a nice control panel, an official 1-Click Docker image, and documentation that does not make assumptions about which team you are on.

There is one more reason DigitalOcean shows up disproportionately in this niche: the DigitalOcean Community has a growing catalog of AI-agent tutorials and 1-Click Marketplace images (Docker Agent, Ollama, agent-friendly base images) that make the first hour of setup shorter than it should be. If your agent runtime already ships as a container, half the "getting to a live agent" fight is basically done for you.

This walkthrough is for the reader who has chosen DigitalOcean and wants to run a self-hosted AI agent (Hermes Agent, an n8n workflow with an LLM node, an OpenAI Assistants proxy, anything that calls a model API from a long-lived server) without skipping the parts that matter at 3 AM. Sizing, hardening, Docker Compose, a Telegram test, and the honest list of things that will break.

If you are still deciding between providers, our Hetzner walkthrough and the wider cheap VPS comparison cover the field. This post assumes DigitalOcean.

Step 1: Pick the Right Droplet

DigitalOcean's shared-CPU line in 2026 splits into three groups you actually see in the create-Droplet UI:

Regular Intel - the classic shared vCPUs, oldest and slowest per dollar
Premium Intel / Premium AMD - newer chips, faster single-thread
Basic AMD (per-second billed) - the current sweet spot for small services

For an API-driven agent (one that calls OpenAI, Anthropic, OpenRouter, or your own Ollama box and orchestrates tool calls locally), model inference happens on the provider's servers. The Droplet only has to run the agent process, a Telegram gateway, and a Docker daemon, so you do not need much CPU. RAM is the constraint.

Plan	vCPU	RAM	NVMe	Price	Verdict
s-1vcpu-512mb-10gb	1	512 MB	10 GB	$4/mo	Too tight, OOM the first time a skill loads
s-1vcpu-1gb	1	1 GB	25 GB	$6/mo	Fine for a bare agent doing pure API calls
s-1vcpu-2gb	1	2 GB	50 GB	$12/mo	Fine for one agent, no headroom for a second service
s-2vcpu-4gb-amd	2	4 GB	80 GB	$28/mo	Right default: agent + memory + Playwright + reverse proxy
s-2vcpu-4gb (Intel)	2	4 GB	80 GB	$24/mo	Same specs, older CPU

DigitalOcean moved to per-second billing (60-second minimum) on January 1, 2026, so a Droplet you spin up to try this out and destroy the same afternoon costs cents, not a month. Every Droplet ships with a bandwidth allowance (1 TB on the $6 tier, 4 TB on the $24-28 tier), which is more than enough for an agent that mostly relays chat messages.

Recommendation: start with s-2vcpu-4gb-amd. Two vCPU and 4 GB of RAM leaves headroom for the agent, a small IMAP polling task, a headless browser skill, and a reverse proxy, without OOM surprises the first time your memory backend writes a batch to disk. If your only workload is a chat agent hitting a cloud model, the $6 s-1vcpu-1gb tier is genuinely enough.

Skip the $4 tier for anything running Docker plus a memory volume plus a Telegram gateway. It will cross the OOM threshold within a week.

Step 2: Lock the Droplet Down Before You SSH In

This is the step that gets skipped and bites later. DigitalOcean gives you a Cloud Firewall that runs at the hypervisor level, before packets even reach the VM. Configure it before the Droplet boots so the box never accepts a packet on a port you did not intend to open.

In the DigitalOcean Console, go to Networking > Firewalls > Create Firewall. Inbound rules:

SSH (TCP 22) from My IP only (or a small CIDR if you have a fixed office range)
HTTP (TCP 80) from All IPv4, All IPv6 (only if you will run a reverse proxy)
HTTPS (TCP 443) from All IPv4, All IPv6 (only if you need HTTPS webhooks or a web UI)
ICMP from All IPv4, All IPv6 (so uptime pings work)

Outbound: leave the defaults - the agent needs to reach the model API. Attach this firewall to the Droplet during creation. Do not create the Droplet first and firewall it later.

For a stronger setup, close port 22 to the internet entirely and reach the box over Tailscale. DigitalOcean has a Tailscale 1-Click app and Tailscale's own docs cover the "close port 22 forever" flow. The Cloud Firewall drops SSH probes at the edge, so they never hit fail2ban or your logs.

When creating the Droplet, pick Ubuntu 24.04 LTS, paste your SSH public key, attach the firewall, and hit Create. Once the Droplet is up, SSH in as root and immediately do four things:

# 1. Patch
apt update && apt upgrade -y && apt install -y ufw fail2ban unattended-upgrades

# 2. Create a non-root user
adduser --disabled-password --gecos "" agent
usermod -aG sudo agent
mkdir -p /home/agent/.ssh && cp ~/.ssh/authorized_keys /home/agent/.ssh/
chown -R agent:agent /home/agent/.ssh && chmod 600 /home/agent/.ssh/authorized_keys

# 3. Lock down SSH
sed -i 's/^#*PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sed -i 's/^#*PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
systemctl restart ssh

# 4. Host firewall (UFW), redundant with the Cloud Firewall but a useful safety net
ufw default deny incoming && ufw default allow outgoing
ufw allow OpenSSH && ufw allow 80/tcp && ufw allow 443/tcp
ufw --force enable

Then turn on unattended security upgrades and fail2ban:

dpkg-reconfigure -plow unattended-upgrades   # answer Yes
systemctl enable --now fail2ban

Log out of root, log back in as agent, and continue from there.

Step 3: Install Docker (or Use the 1-Click Image)

You have two paths.

Path A: install Docker on plain Ubuntu. Standard, one line, works everywhere:

curl -fsSL https://get.docker.com | sudo sh
sudo usermod -aG docker agent
newgrp docker
docker run --rm hello-world

Path B: use DigitalOcean's Docker Marketplace image. From the Create Droplet page, pick Marketplace > Docker (Ubuntu 24.04 with Docker preinstalled). You skip the install step and get a preconfigured setup. Same result, one less command.

If your agent runtime publishes an official 1-Click image on DigitalOcean (Docker Agent, Ollama, and a growing list of agent runtimes do), you can go one step further and use that image directly, then only Compose in your own env file and volumes.

Step 4: Deploy the Agent with Docker Compose

Create ~/agent/docker-compose.yml. The example below is generic; swap the image reference for whichever runtime you use.

services:
  agent:
    image: ghcr.io/your-runtime/agent:latest
    container_name: agent
    restart: unless-stopped
    env_file: .env
    volumes:
      - ./data:/data
      - ./skills:/skills
      - ./memory:/memory
    ports:
      - "127.0.0.1:8080:8080"   # web UI bound to localhost only

Then ~/agent/.env:

# Model provider (BYOK - bring your own key)
OPENAI_API_KEY=sk-...
# or ANTHROPIC_API_KEY / OPENROUTER_API_KEY

# Messaging gateway
TELEGRAM_BOT_TOKEN=...
TELEGRAM_ALLOWED_USERS=12345678

# Persistence
DATA_DIR=/data
MEMORY_DIR=/memory

chmod 600 .env so other users on the box cannot read your keys, then bring it up:

docker compose up -d
docker compose logs -f agent

restart: unless-stopped is what keeps the agent alive across Droplet reboots (which DigitalOcean does occasionally for maintenance).

Attach a persistent Volume

The Droplet's root disk is fine for the container, but the agent's state (memory files, skills, conversation history) belongs on a separate DigitalOcean Volume. It survives Droplet destruction, snapshots independently, and can be reattached to a new Droplet if you resize.

In the Console: Volumes > Create > 10 GB > attach to your Droplet. Then on the box:

sudo mkdir -p /mnt/agent-state
sudo mount -o discard,defaults,noatime /dev/sda /mnt/agent-state
echo '/dev/sda /mnt/agent-state ext4 defaults,nofail,discard 0 0' | sudo tee -a /etc/fstab
sudo chown agent:agent /mnt/agent-state

Point the ./data, ./skills, ./memory volumes in docker-compose.yml at subdirectories of /mnt/agent-state. A 10 GB Volume runs about $1/month.

Step 5: Wire Up Telegram and Test

If Telegram is your messaging surface (most self-hosters land there because the Bot API is free and instant), the test loop is short:

Talk to @BotFather, run /newbot, save the token into .env.
Talk to @userinfobot to get your numeric Telegram user ID, put it in TELEGRAM_ALLOWED_USERS.
docker compose restart agent.
Open your new bot and send "hello".

You should see a response within a few seconds. If not, docker compose logs -f agent usually points straight at the problem: missing token, wrong allowed-user ID, or the model provider returning 401.

For a deeper Telegram walkthrough (groups, topics, voice mode, troubleshooting), see how to build an AI agent on Telegram.

Step 6: Backups and Monitoring

Two cheap habits that pay for themselves the first time something breaks:

DigitalOcean Backups or Snapshots. Backups are automated weekly with four-week retention, priced at 20% of the Droplet cost. Snapshots are manual, priced per GB per month (about $0.05/GB/mo). At minimum, tag a snapshot "before-update" before any docker compose pull.
An uptime ping. BetterStack, UptimeRobot, or DigitalOcean's own Uptime product. Hit https://your-domain/health (or a TCP check) every 5 minutes. The first time Telegram long-polling drops at 3 AM you find out before lunch, not at lunch.

For the agent's own state on the Volume, a one-line cron that tars /mnt/agent-state into /var/backups/agent-$(date +%F).tar.gz, plus an rsync to DigitalOcean Spaces (S3-compatible, $5/mo starter), is enough. Spaces snapshots the tarballs at object-storage prices, well below the "attach a second Droplet" alternative.

Step 7: Updates

Once a week, with a fresh snapshot:

cd ~/agent
docker compose pull
docker compose up -d
docker image prune -f

Usually under a minute. If the new image breaks, restore the snapshot from the Console. The only state you lose is what was written between the snapshot and now, which sits in the memory Volume.

What Breaks Eventually

The honest list, provider-agnostic and time-tested:

Telegram long-polling drops during network blips. Most runtimes reconnect; if yours does not, the uptime ping catches it.
docker compose pull :latest ships a breaking config change. Pin image tags to specific versions in production.
Model provider rate-limits you and the agent goes quiet without a clear error. Log HTTP status from the provider client.
The root disk fills up because a skill writes to /tmp without rotation. du -sh /* and docker system df belong in your muscle memory. This is exactly why persistent state lives on a Volume.
You forget the firewall rule when you add a service. Both the Cloud Firewall and UFW need the new port, or you spend 20 minutes debugging "connection refused" from the wrong direction.

None of these are DigitalOcean-specific. They are the tax on running anything yourself.

Cost Reality Check

Rough monthly numbers for a small production setup on DigitalOcean, mid-2026:

Droplet (s-2vcpu-4gb-amd): $28
10 GB Volume: $1
Weekly Backups: about $5.60
Spaces (offsite backup, 250 GB / 1 TB transfer): $5
Uptime pinger: $0 (free tier)

Total: about $40/month for a properly backed-up, monitored, isolated AI-agent host on DigitalOcean. On Hetzner the same shape lands closer to $8-10/month (EU regions, comparable CPU, 20 TB transfer included), and on AWS EC2 comparable specs land closer to $60-80/month once you add EBS and data transfer. DigitalOcean sits squarely in the middle, priced for the value of the polish, the docs, the 1-Click images, and not having to think about billing tiers.

When the VPS Math Stops Working

If the steps above sound interesting, this is exactly the workflow DigitalOcean is built for. Clean panel, one-click images, an ecosystem full of "how to run X" tutorials.

If they sound like a tax on a weekend, the comparison shifts. Managed hosting trades a small monthly fee and a Sunday afternoon for a setup that already includes the Telegram gateway, BYOK to your model provider, persistent memory, snapshots, and "it stays up while you sleep". Our hosting vs self-hosting guide walks through the full math, including what your time is worth.

Get started with Hermify if you want the managed path, a Hermes Agent on production infrastructure in about a minute, with no Cloud Firewall to configure and no Docker Volumes to attach. If you would rather do it yourself on DigitalOcean, this guide should get you there.