Build Your Own OutLine VPN with Docker: Step-by-Step Guide to Adding Users

Introduction

In this step-by-step tutorial, you'll deploy a personal OutLine VPN server in Docker, connect it with the Outline Manager app, create access keys for yourself and others, and verify stable connections on Windows, macOS, Linux, iOS, and Android. We'll cover every step in detail—from choosing a VPS to routine maintenance—plus security, scaling, and backup advice. The guide is written in straightforward language, without unnecessary theory, yet deep enough to confidently and safely operate your setup in 2026.

Who this guide is for. If you want full control over your traffic, a dedicated IP, no unwanted neighbors, and predictable performance, building your own OutLine VPN is an excellent choice. This guide suits beginners comfortable with the terminal and advanced users who want clear workflows, verifiable steps, and automation tips.

What you’ll get in the end. Your own OutLine Server running in Docker, accessible through the convenient Outline Manager. With just a few clicks, you’ll create new access keys (users), limit traffic, change ports, migrate the server to another machine within minutes if needed, and securely store backup settings.

What you need to know beforehand. Basic Linux command-line skills: how to connect via SSH and run commands with sudo. If you’ve never done this before, don’t worry—we’ll break down every step and show you how to verify each result. You’ll learn not just how, but why.

How long it takes. Allocate 60–90 minutes for a clean installation following this guide, plus 10–20 minutes testing from various devices. If you add advanced options (monitoring, automatic updates, backups), set aside another 30–45 minutes.

Preparation

Before launching Docker and setting up OutLine, make sure you have all the necessary access and tools. Here’s a clear checklist so you don’t miss anything.

Required Tools and Access

• A VPS or dedicated server account with a public IPv4.
• SSH credentials: server IP, username, password or private key.
• A computer running Windows, macOS, or Linux with an SSH client installed. On Windows, built-in OpenSSH or a third-party client works well.
• The Outline Manager app installed on your computer. You’ll need it for easy server and user management.

Server System Requirements

• Operating system: Ubuntu 22.04 LTS or 24.04 LTS, or Debian 12. These are the most reliable choices for Docker.
• Hardware: minimum 1 virtual CPU and 512 MB RAM for 1–3 users; 1–2 GB RAM and 2 CPUs for 5–15 users; 4+ GB RAM and 4 CPUs for 20+ users or high speeds.
• Disk space: 10–20 GB is more than enough. Logs and configs only take a few megabytes.
• Network ports: external access to TCP 443 and UDP 443 is required. Additional ports optionally, if you plan individual ports for different users.

What to Install and Configure

• Docker and the Docker Compose plugin on the server. We’ll install these from the distro repository with standard packages, no extra sources.
• UFW or another firewall on the server for basic incoming traffic filtering.
• Correct server time: enable time synchronization with the system time service. Incorrect time may cause Outline Manager TLS connections to fail.

Backups

At this stage, separate backups aren’t needed yet. Later, we will create a backup of the key access file for the OutLine server so you can restore it in minutes when moving to another host.

Tip: If you’re new to VPS, choose a region closest to your users. The shorter the route to the server, the lower the latency and more stable the connection. This is especially noticeable with video calls and streaming.

Basic Concepts

Before diving into commands, let’s cover some key terms. This will help you better understand why we take certain steps.

• OutLine Server — the server component we deploy in Docker. It runs a Shadowsocks-based proxy and provides a management API for Outline Manager.
• Outline Manager — a separate app through which you connect to your server, create, delete, and limit access keys, and copy ready-to-use user connection links.
• Access Key — a user access key represented by a string containing the server address, port, encryption method, and password. This string is easily imported into OutLine clients.
• Docker — a container environment that lets us run OutLine Server as a bundled unit with all dependencies and automatically restart it after updates.
• UFW — a straightforward firewall on Ubuntu and Debian used to allow necessary ports and block unwanted ones.

How it works. You launch OutLine Server on your VPS. Outline Manager connects to it through the management channel and creates access keys. Users paste keys into the OutLine client, establishing a secure tunnel to your server. Traffic is encrypted, and users appear online with your server’s IP.

What to understand before starting. Network issues are the most common trouble. If TCP and UDP port 443 aren’t open, if the provider blocks UDP, or if server connections are restricted, clients will disconnect. We’ll focus heavily on correct firewall setup and port availability checks.

⚠️ Warning: Don’t confuse OutLine with full L3 VPN protocols. OutLine uses Shadowsocks as a proxy layer. For most uses, this isn’t a problem, but keep it in mind for complex routing scenarios.

Step 1: Choose and Prepare the Server

Goal

Get a ready-to-go VPS with a public IPv4, Ubuntu or Debian installed, working SSH access, and correct time settings.

Step-by-Step Instructions

1. Order a VPS with your chosen provider. Pick a region close to you or your users.
2. Select the OS image: Ubuntu 22.04 LTS, 24.04 LTS, or Debian 12. Choose specs starting at 1 CPU and 1 GB RAM for an easy start.
3. Generate an SSH key on your computer if you don’t have one. On Linux/macOS, run the keygen command; on Windows, use built-in or third-party clients. Keep your private key safe.
4. Add your public SSH key in the VPS setup or save the user password. Using a key is preferred.
5. Wait for the server to be created. Open your provider’s console to confirm the server is online and showing a login prompt.
6. SSH into the server from your computer using the server IP. Enter your login, accept the server key fingerprint, and authorize.
7. Check date and time with the date command. If incorrect, enable time synchronization through the system’s time service.
8. Update the system: run package update commands and reboot if necessary. Reconnect via SSH.

Important: Save your server IP, login, and access method securely. The first SSH connection will always ask to confirm the server's key fingerprint—that’s normal.

Tip: If you plan to use the server heavily during peak hours, choose a plan with guaranteed CPUs instead of heavily oversubscribed ones for more stable speeds.

✅ Check: You can SSH into the server without errors, commands run smoothly, the date/time is accurate, and the system is updated.

Possible issues and fixes: If SSH connection fails, verify that your local internet doesn’t block outbound traffic on port 22 and that the VPS provider hasn’t closed this port. Use the provider's web console to check SSH service and firewall rules if available.

Step 2: Install Docker and Docker Compose

Goal

Install Docker and the Compose plugin from the system repositories, start the service, and ensure containers auto-start on reboot.

Step-by-Step Instructions

1. Remove any old Docker packages to avoid conflicts. Run commands to uninstall previous Docker versions.
2. Update your package index to refresh repo lists.
3. Install docker.io and docker-compose-plugin packages. Confirm and wait for completion.
4. Add your current user to the docker group so you can run containers without sudo. Log out and log back in to apply group changes.
5. Enable Docker service to start at boot and start it right now. Check the service status; it should show "active".
6. Test Docker by pulling and running a test container. Run a simple container and confirm it outputs a message.

If you're using Debian 12, package names and commands are the same. Occasionally, you might need extra dependencies, but typically the standard packages suffice.

Tip: Keep all your future OutLine configuration files in /opt/outline. It simplifies backups, migration, and troubleshooting.

✅ Check: The test container printout appears, Docker service is active, and `docker ps` shows the container list (empty or populated).

Issues and solutions: If Docker doesn’t start, check free disk space and clear old logs and packages. If Docker commands require sudo, you haven’t logged out/in after adding yourself to the docker group.

Step 3: Configure Firewall and Network

Goal

Open only the essential ports for OutLine and avoid conflicts with existing security policies.

Step-by-Step Instructions

1. Check if UFW is enabled. If it's disabled, we’ll enable it later. If enabled, confirm port 22 is open for SSH access.
2. Allow traffic on port 443 for both TCP and UDP. This port is the primary access point for OutLine clients.
3. If you run a web server on port 443, select a different port for OutLine during container setup, like 8443, and allow that port’s TCP and UDP traffic.
4. If needed, open port 80 TCP for issuing certs for the management interface or other services requiring HTTP. The default install doesn’t require port 80.
5. Enable UFW if it was disabled. Confirm SSH remains allowed.
6. Verify rules applied correctly by listing UFW rules.

⚠️ Warning: If you change OutLine’s port from 443 to an uncommon one, make sure it’s open in the firewall and not blocked by your provider. Some corporate networks block non-standard ports.

Tip: If using a cloud provider with a separate network firewall in their panel, open the same ports there. This overlooked second layer often causes hours of troubleshooting.

✅ Check: After enabling UFW, your SSH connection remains stable, port 443 is open to the internet, and unnecessary ports are closed.

Issues and fixes: If you lose SSH after enabling UFW, use the provider’s web console to allow port 22, then restart UFW. If port 443 appears closed externally, check the provider firewall and ensure the container listens on that port.

Step 4: Deploy OutLine Server in Docker

Goal

Run OutLine Server as a Docker container, set up persistent state storage, and ensure it auto-restarts.

Two Reliable Methods

Option A: Auto-install via Outline Manager over SSH

1. Launch Outline Manager on your computer.
2. Select the option to install on your own server. The app will connect via SSH, install Docker if needed, and launch OutLine Server in a Docker container automatically.
3. Enter server IP, username, and authentication method. Confirm connection.
4. Wait for the installation to complete. At the end, Outline Manager will offer to auto-connect to your new server—accept it.

This method is easy for beginners. It installs everything “through Docker,” but Outline Manager handles all the routine work for you.

Option B: Manual Docker container launch

1. Prepare the state directory: create /opt/outline and set proper permissions.
2. Run OutLine container in host network mode to avoid port forwarding hassles. Execute the container run command with restart=always and mount the state directory. Name the container for easy reference.
3. Verify the container is running by listing active containers and checking status.
4. Inspect container logs. Successful initialization shows API readiness and key info.

Explanation: Host network mode lets the container listen on host ports directly, simplifying configuration and reducing UDP issues. /opt/outline holds important files, including Outline Manager access and configs, which you can back up later.

Tip: If using a custom port instead of 443, specify it with an environment variable when launching the container and open that port in the firewall.

✅ Check: Your named container is "Up", logs show no errors, and port checks confirm your server listens on TCP/UDP 443 (or your chosen port).

Issues and fixes: If the container stops immediately, check logs for port conflicts. Free the port or select another. If UDP doesn’t work, clients may connect but experience instability—verify UDP is allowed by your provider and user networks.

Step 5: Get Your Outline Manager Key and Connect

Goal

Locate and save the access string for managing your server via Outline Manager, connect the manager, and confirm it recognizes your server.

Step-by-Step Instructions

1. If you installed via Outline Manager, the key is already known and connection established. Skip to the next step to create users.
2. If installed manually, retrieve the apiUrl string. Check container logs for the line containing apiUrl and copy it completely. If necessary, search logs or open the access file inside the container.
3. Open Outline Manager and choose "Connect to existing server." Paste the copied string and confirm connection.
4. If asked to confirm the certificate fingerprint, match it against what’s in your access string and approve if it matches.
5. Wait a few seconds for the server to appear online and show basic stats.

Tip: Store this access string in a secure password manager. It’s your "admin key" to the server. Losing it means longer, more complex recovery.

✅ Check: Outline Manager shows your server online with available actions: create access key, rename, view traffic stats.

Issues and fixes: If Outline Manager can’t connect, check server and local time, ensure TCP port 443 is open, and no proxy interferes with TLS. Don’t confirm mismatched certificates—double-check server/key details.

Step 6: Add Users and Issue Access

Goal

Create one or more access keys, give them clear names, copy connection links, and securely share them with users.

Using Outline Manager

1. Open your server in Outline Manager. Click "Add key" or "Add access key."
2. Name the key clearly, e.g., "Ivan iPhone," "Maria's laptop," "Home PC." This makes future management easier.
3. Copy the key’s connection link—a string to paste into the OutLine client on the user’s device.
4. Send the link securely using encrypted messengers. Avoid public chats or unencrypted emails.
5. Optionally, limit key traffic. Outline Manager lets you set limits or reset stats manually.

Advanced API Automation

If you want to automate user addition via script, you can interact with the management API. First, create an environment variable with your full apiUrl string from the saved key.

Export this variable, replacing the placeholder with your actual value. Then call the API to create a new key. The response includes full connection data and a link. Save and securely share this link with your user.

List all keys with an API call. Delete keys by ID, which you get from the list response.

Tip: When automating, store only IDs and display names. Keep full key links in encrypted storage and show them only once on issue.

✅ Check: Keys created via GUI or API show proper names, include port/encryption, and import successfully into OutLine clients, establishing connections.

Issues and fixes: If clients don’t connect, verify you copied the full link without trimming characters. Check port availability and ensure UDP isn’t blocked for the user. Try switching to a mobile network to rule out local filters.

Verifying Your Setup

Checklist

• Stable SSH access to the server.
• Docker installed, service active, OutLine container status "Up."
• Ports 443 TCP and UDP (or your chosen ports) open on server and accessible from the internet.
• Outline Manager connected via access string, shows "online" status.
• At least one access key created and imported into OutLine client on a test device.
• Traffic flows through the client, websites load, external IP matches your server.

How to Test

1. Import an access key into your OutLine client and connect.
2. Visit several websites, including one that shows your external IP. Confirm it matches your server IP.
3. Test stability: stream video or do a 5–10 minute audio/video call. Watch for disconnects or delays.
4. If you have a second key/device, test simultaneous connections and compare speeds.

Success indicators: Quickly established connections, smooth browsing, no call interruptions, matching external IP, and accurate traffic stats in Outline Manager.

✅ Check: Outline Manager shows rising traffic during tests on active keys; clients display "Connected" status without errors.

Common Issues and Solutions

• Issue: Client won’t connect. Cause: Ports 443 TCP/UDP closed on server or provider firewall. Fix: Open ports in UFW and provider panel, restart firewall, verify external access.
• Issue: Client connects but speeds are slow. Cause: Overloaded server, distant region, network bottleneck. Fix: Move server closer to users, upgrade plan, monitor CPU and RAM usage, check disk and network health.
• Issue: Outline Manager lost connection after server reboot. Cause: Access file lost or overwritten. Fix: Check /opt/outline for access file, restore from backups, or recreate and reconnect server.
• Issue: Corporate network blocking connection. Cause: UDP or non-standard ports filtered. Fix: Use port 443, have user test on another network or mobile data; temporarily disable UDP-dependent features and monitor.
• Issue: Container logs show startup errors. Cause: Port conflicts or insufficient permissions. Fix: Ensure container runs with host network mode and ports aren’t in use; confirm restart=always flag.
• Issue: Cannot create or delete keys via API. Cause: Wrong token or incorrect apiUrl. Fix: Copy the full access string again without spaces or trimming; ensure server is online in the manager.
• Issue: Connection drops during long sessions. Cause: Client device power-saving, server overheating, or unstable route. Fix: Disable aggressive Wi-Fi power-saving, monitor server CPU load, consider relocating server to a different region.

Tip: When troubleshooting, always check this chain step by step: client → local network → client’s ISP → route to VPS → VPS firewall → Docker container → Outline Manager. It saves a ton of time.

Additional Features

Advanced Settings

• Custom ports: Assign separate ports to specific users for easier management and troubleshooting. Remember to open these ports in your firewall.
• Traffic limits: Outline Manager allows setting traffic caps on keys, handy for temporary or trial access.
• Auto-updates: Set periodic container restarts with image updates to stay current without manual intervention. Ensure your state directory is mounted to keep access intact.
• Backups: Regularly back up /opt/outline and the access key file. This is enough to restore your setup on another server in minutes.
• Security audits: Disable unnecessary services, close unused ports, automate OS updates, and configure Docker to restart on failures.

Optimization

• Server location: Place the server close to your user base or between groups if you have a distributed team.
• Hardware profiles: For few users, a stable CPU matters more than large RAM. For many simultaneous users, monitor network and disk performance.
• Load monitoring: Use simple system resource monitoring to spot bottlenecks before they affect users.

Tip: If your users connect through ISPs that throttle international speeds, host the server in the same region or nearby city. This often improves speed more than upgrading your plan.

FAQ

• Can I use a non-standard port instead of 443? Yes. Specify the port when launching the container and open it in the firewall. Keep in mind some networks block non-standard ports.
• How many users can a minimal server handle? A 1 CPU, 1 GB RAM VPS comfortably supports 3–5 moderate users. For heavier usage, choose 2 CPUs and 2 GB RAM or more.
• How quickly can I move the server to another machine? Copy /opt/outline and the access key file, launch the container on the new host with the same image and mounted directory—access is preserved.
• Are regular backups necessary? Yes. Data size is small, but losing access keys complicates management. Weekly backups or after changes are best practice.
• Is OutLine suitable for gaming? Depends on routing and latency. If the server is nearby and UDP is allowed, OutLine can be stable. Competitive gaming demands millisecond precision, so test first.
• Why does Outline Manager ask to confirm a fingerprint? It protects against man-in-the-middle attacks. Verify the fingerprint matches your access string before confirming.
• Can I use one key on multiple devices? Technically yes, but for easier control, create separate keys for each device.
• How to limit user speeds? OutLine doesn’t offer built-in speed shaping. You can limit traffic volumes. For bandwidth caps, use host-level network policies.
• What if my provider blocks UDP? Use port 443, try other networks or mobile data. Sometimes changing server region helps.
• Do I need a domain name? No, IP-based access works fine. A domain might be useful for other services.

Tip: Create a minimal FAQ doc for your team with common questions and client setup instructions. It cuts down repetitive support issues.

Conclusion

You’ve completed the full setup: picked a server, installed Docker, configured firewall, launched OutLine Server in a container, connected Outline Manager, created users, and tested connections. Now you have a personal, predictable, and scalable network access tool with full control over keys and traffic. Next steps: automate backups of the state directory, enable resource monitoring, and define your internal policy for issuing and revoking access.

Honest recommendation for fast results: self-hosting OutLine takes hours of initial setup and ongoing monitoring. You need to manage updates, backups, ports, and connectivity from various networks. If you want a personal VPN ready "here and now" without console setup, try vpn.how. It’s a personal VPN server with dedicated IPs (not shared), supports WireGuard, OpenVPN, IKEv2, L2TP, and SSTP—choose your protocol. Servers are available in Moscow, St. Petersburg, Amsterdam, Frankfurt, London, New York, San Jose, Chicago, Singapore, Sydney, Madrid, Helsinki, Stockholm, Warsaw, Copenhagen, and Stavanger. Payment methods include Russian cards, SBP, USDT, and BTC. Prices start at 490 RUB/day and 2490 RUB/month with discounts for longer terms. Servers activate automatically in 5 minutes after payment with no logs. This option is ideal when you need predictable results quickly without infrastructure setup.

⚠️ Warning: Never share full access key links in public chats, store them in shared documents, or send them via unencrypted email. Treat them like your banking app passwords.

Tip: Review your issued keys monthly, deleting unused ones and renaming unclear keys. Organized naming saves hours in troubleshooting and audits.

That’s it! You now have a working, clear, and repeatable process for deploying OutLine VPN via Docker and tools to keep your server in excellent shape.