Appwrite vs Supabase vs PocketBase: Best Self-Hosted Firebase Alternative 2026

1
2
3
4
5
6
7

# Download and extract
wget https://github.com/pocketbase/pocketbase/releases/download/v0.25.8/pocketbase_0.25.8_linux_amd64.zip
unzip pocketbase_0.25.8_linux_amd64.zip
chmod +x pocketbase

# Start the server
./pocketbase serve --http 0.0.0.0:8080

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

# /etc/systemd/system/pocketbase.service
[Unit]
Description=PocketBase Backend
After=network.target

[Service]
Type=simple
User=www-data
WorkingDirectory=/opt/pocketbase
ExecStart=/opt/pocketbase/pocketbase serve --http 0.0.0.0:8080
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target

1
2

systemctl enable pocketbase
systemctl start pocketbase

1
2
3
4

# Caddyfile
api.example.com {
    reverse_proxy localhost:8080
}

1
2
3
4
5

docker run -it --rm \
    --volume /var/run/docker.sock:/var/run/docker.sock \
    --volume "$(pwd)"/appwrite:/usr/src/code/appwrite:rw \
    --entrypoint="install" \
    appwrite/appwrite:1.7.0

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59

# docker-compose.yml
version: '3.8'

services:
  appwrite:
    image: appwrite/appwrite:1.7.0
    container_name: appwrite
    restart: unless-stopped
    networks:
      - appwrite
    labels:
      - traefik.enable=true
      - traefik.http.routers.appwrite.rule=Host(`appwrite.example.com`)
      - traefik.http.routers.appwrite.entrypoints=websecure
      - traefik.http.routers.appwrite.tls.certresolver=letsencrypt
    volumes:
      - appwrite-uploads:/storage/uploads:rw
      - appwrite-cache:/storage/cache:rw
      - appwrite-config:/storage/config:rw
      - appwrite-certificates:/storage/certificates:rw
      - appwrite-functions:/storage/functions:rw
    depends_on:
      - mariadb
      - redis
    environment:
      - _APP_ENV=production
      - _APP_OPENSSL_KEY_V1=your-secret-key
      - _APP_DB_PASS=database-password
      - _APP_REDIS_PASS=redis-password

  mariadb:
    image: mariadb:10.11
    container_name: appwrite-mariadb
    restart: unless-stopped
    networks:
      - appwrite
    volumes:
      - appwrite-mariadb:/var/lib/mysql
    environment:
      - MYSQL_ROOT_PASSWORD=database-password

  redis:
    image: redis:7-alpine
    container_name: appwrite-redis
    restart: unless-stopped
    networks:
      - appwrite

volumes:
  appwrite-uploads:
  appwrite-cache:
  appwrite-config:
  appwrite-certificates:
  appwrite-functions:
  appwrite-mariadb:

networks:
  appwrite:
    driver: bridge

1
2
3
4
5
6
7
8
9

# Install the CLI
curl -fsSL https://raw.githubusercontent.com/supabase/cli/main/install.sh | sh

# Initialize a new project
mkdir supabase-project && cd supabase-project
supabase init

# Start all services locally
supabase start

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78

# docker-compose.yml
version: '3.8'

services:
  db:
    image: supabase/postgres:15.1.1.78
    container_name: supabase-db
    restart: unless-stopped
    ports:
      - "5432:5432"
    volumes:
      - db-data:/var/lib/postgresql/data
    environment:
      POSTGRES_PASSWORD: your-super-secret-postgres-password
      JWT_SECRET: your-jwt-secret-at-least-32-chars
    healthcheck:
      test: pg_isready -U postgres
      interval: 10s
      timeout: 5s
      retries: 5

  kong:
    image: kong:2.8.1
    container_name: supabase-kong
    restart: unless-stopped
    ports:
      - "8000:8000"
      - "8443:8443"
    environment:
      KONG_DATABASE: "off"
      KONG_DECLARATIVE_CONFIG: /var/lib/kong/kong.yml
    volumes:
      - ./volumes/api/kong.yml:/var/lib/kong/kong.yml:ro

  auth:
    image: supabase/gotrue:v2.164.0
    container_name: supabase-auth
    restart: unless-stopped
    environment:
      GOTRUE_API_HOST: 0.0.0.0
      GOTRUE_DB_DATABASE_URL: postgres://postgres:your-super-secret-postgres-password@db:5432/postgres
      GOTRUE_JWT_SECRET: your-jwt-secret-at-least-32-chars
      GOTRUE_SITE_URL: http://localhost:3000
      GOTRUE_MAILER_AUTOCONFIRM: "true"

  rest:
    image: postgrest/postgrest:v12.2.0
    container_name: supabase-rest
    restart: unless-stopped
    environment:
      PGRST_DB_URI: postgres://postgres:your-super-secret-postgres-password@db:5432/postgres
      PGRST_JWT_SECRET: your-jwt-secret-at-least-32-chars
      PGRST_DB_SCHEMAS: public

  realtime:
    image: supabase/realtime:v2.33.45
    container_name: supabase-realtime
    restart: unless-stopped
    environment:
      DB_HOST: db
      DB_PORT: 5432
      DB_PASSWORD: your-super-secret-postgres-password

  storage:
    image: supabase/storage-api:v1.14.5
    container_name: supabase-storage
    restart: unless-stopped
    environment:
      POSTGREST_URL: http://rest:3000
      STORAGE_BACKEND: file
      FILE_STORAGE_BACKEND_PATH: /var/lib/storage
      GLOBAL_S3_BUCKET: local
    volumes:
      - storage-data:/var/lib/storage

volumes:
  db-data:
  storage-data:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

// migrations/1680000000_create_posts.js
migrate((db) => {
  const collection = new Collection({
    name: "posts",
    type: "base",
    schema: [
      { name: "title", type: "text", required: true },
      { name: "body", type: "editor", required: true },
      { name: "author", type: "relation", required: true, options: { collectionId: "users" } },
      { name: "published", type: "bool", default: false },
    ],
    listRule: "published = true",
    viewRule: "published = true || author.id = @request.auth.id",
    createRule: "@request.auth.id != '' && author.id = @request.auth.id",
    updateRule: "author.id = @request.auth.id",
    deleteRule: "@request.auth.id = author.id",
  });

  return db.save(collection);
});

1
2
3
4
5
6
7
8

# List published posts
curl http://localhost:8080/api/collections/posts/records?filter=published=true

# Create a post (authenticated)
curl -X POST http://localhost:8080/api/collections/posts/records \
  -H "Authorization: Bearer YOUR_JWT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"title":"Hello World","body":"Content here"}'

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

// Using the Appwrite Web SDK
import { Client, Databases, ID } from 'appwrite';

const client = new Client()
  .setEndpoint('https://appwrite.example.com/v1')
  .setProject('your-project-id');

const databases = new Databases(client);

// Create a document
const doc = await databases.createDocument(
  'my-database',
  'posts',
  ID.unique(),
  {
    title: 'Hello World',
    body: 'Content here',
    published: true,
  },
  ['role:all'] // permissions
);

// Query with filters
const results = await databases.listDocuments(
  'my-database',
  'posts',
  [
    Query.equal('published', true),
    Query.orderDesc('$createdAt'),
    Query.limit(10),
  ]
);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

-- Create a table with Row-Level Security
CREATE TABLE posts (
  id uuid DEFAULT gen_random_uuid() PRIMARY KEY,
  title text NOT NULL,
  body text NOT NULL,
  author_id uuid REFERENCES auth.users(id),
  published boolean DEFAULT false,
  created_at timestamptz DEFAULT now()
);

-- Enable Row-Level Security
ALTER TABLE posts ENABLE ROW LEVEL SECURITY;

-- Policy: anyone can read published posts
CREATE POLICY "Published posts are viewable by everyone"
  ON posts FOR SELECT
  USING (published = true);

-- Policy: authors can insert their own posts
CREATE POLICY "Authors can create posts"
  ON posts FOR INSERT
  WITH CHECK (auth.uid() = author_id);

-- Policy: authors can update their own posts
CREATE POLICY "Authors can update their own posts"
  ON posts FOR UPDATE
  USING (auth.uid() = author_id);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# List published posts
curl "http://localhost:8000/rest/v1/posts?published=eq.true&order=created_at.desc&limit=10" \
  -H "apikey: YOUR_ANON_KEY"

# Create a post (authenticated)
curl -X POST "http://localhost:8000/rest/v1/posts" \
  -H "apikey: YOUR_ANON_KEY" \
  -H "Authorization: Bearer USER_JWT" \
  -H "Content-Type: application/json" \
  -H "Prefer: return=representation" \
  -d '{"title":"Hello World","body":"Content here","author_id":"uuid-here"}'

1
2
3
4
5
6

import PocketBase from 'pocketbase';
const pb = new PocketBase('http://localhost:8080');

pb.collection('posts').subscribe('*', (data) => {
  console.log('Real-time update:', data.record);
}, { expand: 'author' });

1
2
3
4
5
6
7

import { Client, Realtime } from 'appwrite';

const realtime = new Realtime(client);

realtime.subscribe(['databases.my-database.collections.posts.documents'], (response) => {
  console.log('Real-time event:', response.payload);
});

1
2
3
4
5
6
7
8
9

import { createClient } from '@supabase/supabase-js';
const supabase = createClient('http://localhost:8000', 'YOUR_ANON_KEY');

supabase
  .channel('posts-changes')
  .on('postgres_changes', { event: '*', schema: 'public', table: 'posts' }, (payload) => {
    console.log('Change received:', payload);
  })
  .subscribe();

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

// hooks.js
onRecordAfterCreateRequest((e) => {
  const record = e.record;
  console.log('New post created:', record.get('title'));

  // Send email notification, trigger webhook, etc.
  const mailer = $app.newMail();
  mailer.to = 'admin@example.com';
  mailer.subject = 'New post: ' + record.get('title');
  $app.send(mailer);
}, 'posts');

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

// functions/hello-world/index.js
export default async ({ req, res, log, error }) => {
  log('Incoming request:', req.body);

  const payload = { response: 'Hello from Appwrite Functions!' };

  return res.json(payload, 200, {
    'Content-Type': 'application/json',
  });
};

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

// supabase/functions/hello/index.ts
import { serve } from 'https://deno.land/std@0.168.0/http/server.ts';

serve(async (req) => {
  const { name } = await req.json();

  return new Response(
    JSON.stringify({ message: `Hello, ${name}!` }),
    { headers: { 'Content-Type': 'application/json' } }
  );
});

1

supabase functions deploy hello --project-ref your-project-ref

1
2
3
4
5

# Manual backup
cp -r /opt/pocketbase/pb_data /backups/pb_data_$(date +%F)

# Litestream replication to S3
litestream replicate -config /etc/litestream.yml /opt/pocketbase/pb_data/data.db

1
2
3
4
5

# Backup MariaDB
docker exec appwrite-mariadb mysqldump -u root -p'${MYSQL_ROOT_PASSWORD}' --all-databases > backup.sql

# Backup volumes
docker run --rm -v appwrite-uploads:/data -v $(pwd):/backup alpine tar czf /backup/appwrite-uploads.tar.gz -C /data .

1
2
3
4
5

# Logical backup
docker exec supabase-db pg_dump -U postgres -F c -f /var/lib/postgresql/backup/full.dump

# Point-in-time recovery with WAL-G
docker exec supabase-db wal-g backup-push /var/lib/postgresql/data

1
2
3
4
5
6
7
8
9

# PocketBase — download, extract, run
curl -fsSL https://github.com/pocketbase/pocketbase/releases/latest/download/pocketbase_linux_amd64 -o pocketbase
chmod +x pocketbase && ./pocketbase serve

# Appwrite — one command
docker run -it --rm --volume /var/run/docker.sock:/var/run/docker.sock --volume "$(pwd)"/appwrite:/usr/src/code/appwrite:rw --entrypoint="install" appwrite/appwrite:latest

# Supabase — CLI based
npx supabase init && npx supabase start