Self-hosted, side by side
How Nelcota compares
Self-hosted Supabase, PocketBase and self-hosted Appwrite, feature by feature. Including what Nelcota does not have yet.
See the full tableChecked against each project’s official docs on . Something wrong or out of date? Open an issue
The short version
Where Nelcota comes out ahead
-
Memory
Fits a small server
Self-hosted Supabase and Appwrite ask for at least 4 GB of RAM. Nelcota’s deploy guide fits 2–3 small projects on a 1 GB VPS.
-
Pieces to run
Two things to run
One Rust binary and PostgreSQL, plus Caddy for HTTPS. Self-hosted Supabase runs 11 containers; Appwrite, a stack with Redis, ClickHouse and workers.
-
Backups
Point-in-time recovery on your server
Built into the CLI. On Supabase and Appwrite, built-in backups only exist in their paid cloud plans.
-
Access
PostgreSQL decides access
Row-level security, as on Supabase: the same rules cover the API, files and the panel’s “View as”. PocketBase and Appwrite use rule layers of their own.
Including the gaps
Feature comparison
| Feature | Nelcota 0.4.0 | Supabase self-hosted, Oct 2026 | PocketBase 0.40.5 | Appwrite 2.5.0 |
|---|---|---|---|---|
| Architecture | ||||
| What you run | One Rust binary + PostgreSQL, on Docker Compose (default) or systemd. Caddy adds HTTPS. | 11 containers in the official Docker setup | One Go binary, database embedded | A Docker stack: API, background workers, Redis, ClickHouse, Traefik and more |
| Database | PostgreSQL 17 | PostgreSQL 17 | SQLite, embedded. No PostgreSQL. | PostgreSQL by default; MariaDB or MongoDB also offered |
| Written in | Rust | TypeScript, Go, Haskell, Elixir and Rust, per service | Go | PHP (Swoole) |
| License | Apache-2.0 | Apache-2.0 and MIT, per component | MIT | BSD-3-Clause |
| Hardware | No stated minimum. The deploy guide estimates 2–3 small projects on a 1 GB VPS. | Minimum 2 CPU, 4 GB RAM | No stated minimum | Minimum 2 CPU, 4 GB RAM, 2 GB swap |
| Maturity | Partly, or with limits: 0.x: upgrades can bring breaking changes | Included: Generally available since April 2024 | Partly, or with limits: Pre-1.0: no backward-compatibility guarantee | Included: Stable 2.x releases |
| Data and access | ||||
| API from your schema | Included: REST with filters, relations and RPC, plus OpenAPI | Included: REST (PostgREST) and GraphQL (pg_graphql) | Included: REST for each collection | Included: REST and GraphQL over tables you define in Appwrite |
| Access rules enforced by PostgreSQL (RLS) | Included: RLS policies and GRANTs on every API request; service_role bypasses them | Included: RLS policies and GRANTs; service_role bypasses them | Not included: Own API rules per collection (filter expressions) | Not included: Own permissions per resource, with optional row security |
| Realtime subscriptions | Not included: Not yet | Included: Database changes, broadcast and presence | Included: Server-Sent Events | Included: WebSocket channels |
| Code on the server | Partly, or with limits: SQL functions called through RPC; no function runtime | Included: Edge Functions (Deno) | Included: JavaScript hooks, or extend it in Go | Included: Functions in Node, Python, Go, Rust and 10 more runtimes |
| Sign-in | ||||
| Email and password | Included: Argon2id hashes | Included: Included | Included: Included | Included: Argon2 hashes |
| Passwordless email | Included: Magic link | Included: Magic link and one-time code | Included: One-time code | Included: Magic URL and one-time code |
| Social sign-in (OAuth) | Partly, or with limits: Google and GitHub | Included: 19 providers, plus custom OIDC | Included: 30+ providers, plus generic OIDC | Included: 40+ providers, including OIDC |
| Multi-factor authentication | Not included: Not yet | Included: Authenticator app or phone | Included: Any two sign-in methods | Included: Included |
| Files and events | ||||
| File storage | Included: Disk or S3; access by SQL policies, plus signed URLs | Included: Disk or S3, also speaks the S3 protocol | Included: Disk or S3 | Included: Disk, S3 and other providers |
| Image transformations | Not included: Not yet | Included: Resize and format (imgproxy) | Partly, or with limits: Thumbnails only | Included: Resize, crop, format and more |
| Outgoing webhooks | Included: Sent after commit, signed, retried | Included: Database webhooks (triggers with pg_net) | Not included: Not built in; you write them in hooks | Included: Signed, on auth, data, storage and function events |
| Operations | ||||
| Admin panel | Included: Built into the binary, in English and Portuguese | Included: Studio, one project per install | Included: Built into the binary | Included: Console |
| Backups and point-in-time recovery | Included: CLI backups, plus PITR with pgBackRest to S3 | Not included: Managed backups and PITR are cloud-only | Partly, or with limits: Built-in backups to disk or S3; no PITR | Not included: Built-in backups are cloud-only |
| Managed cloud | Not included: No: you host it | Included: Free and paid plans | Not included: No: self-hosted only | Included: Free and paid plans |
| Official SDKs | TypeScript, Rust | JavaScript, Flutter, Swift, Python and more | JavaScript, Dart | Web, Flutter, React Native, Apple, Android and 10 server languages |
- Included
- Partly, or with limits
- Not included
Four good projects
Which one fits
They are all good projects. They solve different problems.
- @nelcota
Nelcota
0.4.0
You want PostgreSQL to be the one place that decides access, one Rust binary on your own VPS, and backups with point-in-time recovery from the CLI. It is 0.x and has no realtime, function runtime or MFA yet.
- @supabase
Supabase
self-hosted, Oct 2026
You need realtime, Edge Functions, MFA or a managed cloud today, with the largest PostgreSQL BaaS ecosystem, and can run a bigger stack or pay for hosting.
- @pocketbase
PocketBase
0.40.5
SQLite on one server is enough and you want the smallest setup there is, with realtime, hooks and backups in a single binary.
- @appwrite
Appwrite
2.5.0
You want functions in many languages, a wide choice of sign-in methods and SDKs for every platform, with a managed cloud if you prefer not to host it.
Every cell, sourced
Sources
Every cell comes from these pages. Versions change; the date at the top says when we checked.