Karakeep on VPS: installation, configuration, and maintenance

Karakeep on a VPS is an effective solution for centralized management of secrets, passwords, and confidential information, allowing you to deploy your own secure password manager on a virtual server. This ensures complete control over your data and its confidentiality, which is critically important for both individuals and small to medium-sized businesses.

In a world where digital assets and confidential data are becoming increasingly valuable, reliable password and secret management is transforming from a desirable option into an absolute necessity. Traditional cloud-based password managers, while convenient, do not always meet the requirements of users seeking maximum control over their data. This is where Karakeep self-hosted comes to the rescue – an open-source solution that you can install on your own VPS server. This not only gives you complete sovereignty over your information but also allows you to configure the system to your unique needs, bypassing reliance on third-party providers.

In this detailed article, we will explore how to perform a Karakeep installation on a Valebyte.com virtual server, starting with system requirements and ending with configuring secure access via a Reverse Proxy with HTTPS, as well as discussing maintenance and choosing the optimal VPS configuration.

What is Karakeep and why do you need it on a VPS?

Karakeep is a modern, secure, and feature-rich open-source secret and password manager. It is designed with an emphasis on ease of use, a high degree of data protection, and the ability for self-hosting. Unlike many commercial counterparts, Karakeep gives you complete control over where and how your confidential data is stored. This is especially valuable for users who do not trust third parties with their passwords or have strict regulatory compliance requirements.

Advantages of Karakeep self-hosted on your own server

Choosing Karakeep on a server, particularly on a VPS, offers a number of undeniable advantages:

• Full Data Control: All your passwords and secrets are stored on your own VPS, not on third-party company servers. You decide where they reside and who has access to them.
• High Security: You have complete control over the infrastructure on which Karakeep runs. This allows you to implement your own security policies, firewalls, intrusion detection systems, and other protective measures that may not be available from commercial providers.
• Customization and Scaling: You can adapt Karakeep to your needs, integrate it with other systems, and scale VPS resources as your requirements grow, without being tied to cloud service pricing plans.
• No Subscription Fees: Karakeep is free, and the cost of ownership is limited only to VPS hosting expenses. This makes it an economically viable solution in the long run.
• Privacy: The absence of telemetry and data collection by Karakeep developers provides an additional layer of privacy.

Key Features and Use Cases for Karakeep

Karakeep offers a rich set of features, making it a powerful tool for secret management:

• Password and Note Storage: Secure storage of credentials, API keys, SSH keys, confidential notes, and any other text information.
• Organization and Search: Ability to group secrets into folders, add tags, and powerful search for quickly finding needed information.
• Password Generator: Built-in generator for creating strong, complex passwords that meet specified criteria.
• Two-Factor Authentication (2FA): TOTP support for additional account protection.
• Change History: Tracking all changes made to secrets, with the ability to revert to previous versions.
• Shared Access: Ability to securely share secrets with trusted users or teams (although Karakeep is primarily focused on personal use, it can be adapted for small teams).
• Web Interface: An intuitive and responsive web interface accessible from any device.

Use cases for Karakeep on a VPS are diverse: from a personal password manager for a tech-savvy user to a centralized secret storage for a small team of developers or system administrators who need secure access to server and service credentials.

System Requirements for Karakeep Installation on a Server

Before proceeding with the Karakeep installation, it's important to ensure that your VPS meets the minimum system requirements. Karakeep, like most modern web applications, runs in Docker containers, which simplifies deployment but requires certain resources.

Minimum and Recommended VPS Resources for Karakeep

Choosing the right VPS configuration is critical for Karakeep's stable and fast operation. Minimum requirements are suitable for individual use or a very small team (up to 3-5 users) with infrequent access. For more active use and scaling, recommended parameters should be considered.

• Processor (CPU):
  • Minimum: 1 vCPU with a clock speed of 2.0 GHz or higher.
  • Recommended: 2 vCPUs with a clock speed of 2.5 GHz or higher.
• Random Access Memory (RAM):
  • Minimum: 1 GB. This will be sufficient for the Karakeep Docker container and its database (SQLite by default).
  • Recommended: 2 GB or more. If you plan to use PostgreSQL or MySQL in a separate container, as well as run other services on the same VPS, 2 GB RAM will be much more comfortable.
• Disk Space (Storage):
  • Minimum: 10 GB NVMe/SSD. The Karakeep installation itself takes up little space, but you need room for the operating system, Docker images, the database, and future backups. NVMe/SSD drives significantly improve database performance.
  • Recommended: 20-30 GB NVMe/SSD. This will provide room for database growth, logs, and a sufficient number of backups.
• Network Bandwidth:
  • Minimum: 100 Mbps.
  • Recommended: 1 Gbps. High network speed ensures fast access to the Karakeep web interface.
• Operating System:
  • Any modern Linux distribution that supports Docker: Ubuntu Server (20.04 LTS or newer), Debian (11 or newer), CentOS Stream (8 or newer), AlmaLinux, Rocky Linux.

For example, for personal use or a small team, Valebyte.com plans with 2 vCPUs, 2 GB RAM, and a 20 GB NVMe disk will be an ideal start. If you haven't decided on hosting yet, you can check out our guide What is a Server and a Dedicated Server: A Complete Guide for Beginners.

Required Software for Karakeep Docker

For a successful Karakeep installation on a VPS, you will need the following software:

1. Docker Engine: The main platform for running and managing containers.
2. Docker Compose: A tool for defining and running multi-container Docker applications. Karakeep will be deployed using it.
3. Git (optional, but recommended): For cloning the Karakeep repository or simply for managing configuration files.
4. UFW (Uncomplicated Firewall) or another firewall: To provide basic security and restrict access to ports.
5. Nginx or Caddy (optional, but highly recommended): For configuring a reverse proxy and automatically obtaining SSL certificates (HTTPS).

Ensure that your VPS has a public IP address and a domain name if you plan to access Karakeep from the internet using HTTPS. The domain name must be linked to your VPS's IP address via an A-record in DNS.

Step-by-Step Karakeep Installation on a VPS using Docker Compose

Karakeep installation via Docker Compose is the most recommended and straightforward deployment method. This approach ensures application isolation, simplifies dependency management, and facilitates updates.

Preparing the VPS for Docker Installation

Before deploying Karakeep Docker, you need to prepare your VPS:

1. Connect to the VPS via SSH:

   ssh user@your_vps_ip

   Replace user with your username (usually root or a user you created), and your_vps_ip with your server's IP address.
2. Update the system:

   sudo apt update && sudo apt upgrade -y # For Debian/Ubuntu
   sudo dnf update -y # For CentOS/AlmaLinux/Rocky Linux

3. Install Docker Engine:

   For Debian/Ubuntu:

   # Remove old versions of Docker (if any)
   for pkg in docker.io docker-doc docker-compose docker-compose-v2 podman-docker containerd runc; do sudo apt remove $pkg; done
   
   # Install necessary packages
   sudo apt update
   sudo apt install ca-certificates curl gnupg -y
   
   # Add Docker's official GPG key
   sudo install -m 0755 -d /etc/apt/keyrings
   curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
   sudo chmod a+r /etc/apt/keyrings/docker.gpg
   
   # Add the Docker repository
   echo \
     "deb [arch="$(dpkg --print-architecture)" signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
     "$(. /etc/os-release && echo "$VERSION_CODENAME")" stable" | \
     sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
   
   # Install Docker Engine, containerd, and Docker Compose
   sudo apt update
   sudo apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin -y

   For CentOS/AlmaLinux/Rocky Linux:

   # Remove old versions of Docker (if any)
   sudo dnf remove docker \
                     docker-client \
                     docker-client-latest \
                     docker-common \
                     docker-latest \
                     docker-latest-logrotate \
                     docker-logrotate \
                     docker-engine
   
   # Install dnf-utils
   sudo dnf -y install dnf-utils
   
   # Add the Docker repository
   sudo dnf config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
   
   # Install Docker Engine, containerd, and Docker Compose
   sudo dnf install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin -y

4. Add your user to the Docker group (if you are not using root):

   sudo usermod -aG docker $USER
   newgrp docker # Apply changes without reconnecting

5. Start Docker and check its status:

   sudo systemctl start docker
   sudo systemctl enable docker
   docker run hello-world

   If you see the message "Hello from Docker!", then Docker is installed and working correctly.
6. Configure the firewall (UFW):

   Open SSH (port 22), HTTP (port 80), and HTTPS (port 443):

   sudo ufw allow ssh
   sudo ufw allow http
   sudo ufw allow https
   sudo ufw enable

   Confirm firewall activation (y). Check status: sudo ufw status.

Creating the docker-compose.yml file for Karakeep Docker

Now, let's create a directory for Karakeep and the docker-compose.yml file. In this file, we will describe the services required for Karakeep to operate.

1. Create a directory for the project:

   mkdir -p ~/karakeep
   cd ~/karakeep

2. Create the docker-compose.yml file:

   nano docker-compose.yml

3. Paste the following content into the file:

version: '3.8'

services:
  karakeep:
    image: ghcr.io/karakeep/karakeep:latest
    container_name: karakeep
    restart: unless-stopped
    ports:
      - "8000:8000" # Default port for Karakeep
    volumes:
      - ./data:/app/data # Karakeep data storage
    environment:
      - DATABASE_URL=sqlite:///app/data/karakeep.db # Using SQLite
      - APP_SECRET=your_super_secret_key # IMPORTANT: Replace with a strong random key!
      - KARAKEEP_ROOT_URL=http://localhost:8000 # Replace with your domain after Nginx/Caddy setup
      # - PUID=1000 # User ID under which the container will run (optional)
      # - PGID=1000 # Group ID (optional)
      # If you want to use PostgreSQL instead of SQLite, uncomment the following lines and configure
      # - DATABASE_URL=postgresql://user:password@db:5432/karakeep
      # depends_on:
      #   - db

  # db: # Optional, if you are using PostgreSQL
  #   image: postgres:15-alpine
  #   container_name: karakeep_db
  #   restart: unless-stopped
  #   environment:
  #     POSTGRES_USER: user
  #     POSTGRES_PASSWORD: password
  #     POSTGRES_DB: karakeep
  #   volumes:
  #     - ./db_data:/var/lib/postgresql/data

Important notes:

• APP_SECRET: This is a critically important key for the security of your Karakeep instance. Do not use the default value! Generate a long, random string (e.g., using openssl rand -hex 32 or an online generator).
• KARAKEEP_ROOT_URL: For now, leave it as http://localhost:8000. After configuring the Reverse Proxy and HTTPS, you will replace it with your domain, for example, https://karakeep.yourdomain.com.
• Data Storage: ./data:/app/data mounts the data directory on your VPS into the container. This is where the SQLite database and other Karakeep files will be stored.
• PostgreSQL (optional): If you plan to scale Karakeep or prefer a more robust database, uncomment the db section and the corresponding lines in the karakeep section. Don't forget to change user, password, and karakeep to your own values. PostgreSQL will require a bit more RAM (minimum 2GB for the VPS).

Starting Karakeep and Initial Setup

After creating docker-compose.yml, you are ready to start Karakeep.

1. Start the containers:

   docker compose up -d

   The -d option runs the containers in detached mode (in the background).
2. Check container status:

   docker compose ps

   You should see that the karakeep container (and karakeep_db if you used PostgreSQL) is in the "Up" state.
3. View logs (for debugging):

   docker compose logs karakeep

4. Initial access:

   Karakeep is now accessible at http://your_vps_ip:8000. Open this address in your browser. You will see the Karakeep welcome page, where you will need to create the first administrative user. Be sure to use a strong password!

   At this stage, Karakeep self-hosted is already running, but access to it is via HTTP and a direct IP address with a port. For secure and convenient access from the internet, you need to configure a Reverse Proxy with HTTPS.

Configuring Reverse Proxy and HTTPS for Karakeep

Direct access to Karakeep via an IP address and port 8000 is insecure and inconvenient. To ensure security, use a domain name, and encrypt traffic (HTTPS), you need to configure a Reverse Proxy. We will cover two popular options: Nginx and Caddy.

Configuring Nginx as a Reverse Proxy

Nginx is a powerful and widely used web server that is excellent for acting as a reverse proxy. It can also integrate with Let's Encrypt for automatic SSL certificate acquisition.

1. Install Nginx:

   sudo apt install nginx -y # For Debian/Ubuntu
   sudo dnf install nginx -y # For CentOS/AlmaLinux/Rocky Linux

2. Start Nginx and enable it to start on boot:

   sudo systemctl start nginx
   sudo systemctl enable nginx

3. Create a configuration file for Karakeep:

   sudo nano /etc/nginx/sites-available/karakeep.conf

   Replace karakeep.yourdomain.com with your domain name.
4. Paste the following configuration:

   server {
       listen 80;
       listen [::]:80;
       server_name karakeep.yourdomain.com; # Replace with your domain
   
       location / {
           proxy_pass http://localhost:8000; # The port Karakeep runs on inside the VPS
           proxy_set_header Host $host;
           proxy_set_header X-Real-IP $remote_addr;
           proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
           proxy_set_header X-Forwarded-Proto $scheme;
           proxy_redirect off;
       }
   }

5. Activate the configuration and check syntax:

   sudo ln -s /etc/nginx/sites-available/karakeep.conf /etc/nginx/sites-enabled/
   sudo nginx -t

   If there are no errors, reload Nginx:

   sudo systemctl reload nginx

   Karakeep should now be accessible at http://karakeep.yourdomain.com.
6. Install Certbot for HTTPS (Let's Encrypt):

   sudo snap install core; sudo snap refresh core
   sudo snap install --classic certbot
   sudo ln -s /snap/bin/certbot /usr/bin/certbot
   
   sudo certbot --nginx -d karakeep.yourdomain.com

   Follow the Certbot instructions. It will automatically configure Nginx for HTTPS and add a rule for automatic certificate renewal.

   After this, your Karakeep will be accessible at the secure address https://karakeep.yourdomain.com.

Configuring Caddy for Automatic HTTPS

Caddy is a modern web server that significantly simplifies HTTPS setup by automatically obtaining and renewing Let's Encrypt certificates. This makes it an excellent choice for Karakeep on a VPS.

1. Remove Nginx (if installed) and stop Karakeep:

   sudo apt remove nginx -y # If you used Nginx
   docker compose down

2. Install Caddy:

   For Debian/Ubuntu:

   sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https
   curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
   curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list
   sudo apt update
   sudo apt install caddy -y

   For CentOS/AlmaLinux/Rocky Linux:

   sudo dnf install 'dnf-command(copr)' -y
   sudo dnf copr enable @caddy/caddy -y
   sudo dnf install caddy -y

3. Create the Caddyfile configuration file:

   sudo nano /etc/caddy/Caddyfile

4. Paste the following configuration, replacing existing content:

   karakeep.yourdomain.com { # Replace with your domain
       reverse_proxy localhost:8000 # The port Karakeep runs on inside the VPS
   }

   That's it! Caddy will automatically obtain an SSL certificate and configure proxying.
5. Restart Caddy:

   sudo systemctl restart caddy
   sudo systemctl enable caddy

   Karakeep should now be accessible at https://karakeep.yourdomain.com.
6. Update KARAKEEP_ROOT_URL in docker-compose.yml:

   Return to the ~/karakeep directory and edit docker-compose.yml:

   nano docker-compose.yml

   Change the line:

         - KARAKEEP_ROOT_URL=http://localhost:8000

   to:

         - KARAKEEP_ROOT_URL=https://karakeep.yourdomain.com # Replace with your domain

   Save the file and restart the Karakeep containers:

   docker compose down
   docker compose up -d

   This is important for the correct functioning of links and other features within Karakeep that need to know their external URL.

Karakeep Maintenance: Backups, Updates, and Monitoring

After a successful Karakeep installation, it's crucial to ensure its stable and secure operation in the long term. Regular backups, timely updates, and continuous monitoring are key aspects of maintaining any self-hosted application.

Karakeep Data Backup Strategies

Karakeep data (your passwords and secrets) is the most valuable part of your installation. Losing this data is catastrophic. Therefore, a reliable backup strategy is absolutely essential.

1. What to back up:

   The main thing to save is the data directory (or db_data if you are using PostgreSQL), which you mounted in docker-compose.yml. It contains the Karakeep database (karakeep.db for SQLite or PostgreSQL files).

   It's also useful to back up your docker-compose.yml file to quickly restore the entire configuration if needed.

2. Backup method (manual):

   Before backing up, it's recommended to stop the Karakeep container to ensure database integrity:

   cd ~/karakeep
   docker compose stop karakeep
   tar -czvf karakeep_backup_$(date +%Y%m%d%H%M%S).tar.gz ./data docker-compose.yml
   docker compose start karakeep

   This command will create a .tar.gz archive containing the data directory and docker-compose.yml. The archive name will include the current date and time.

3. Automated backups:

   For automation, use cron. Create a backup script, for example, ~/karakeep/backup.sh:

   #!/bin/bash
   
   BACKUP_DIR="/root/karakeep_backups" # Change to your desired backup directory
   KARAKEEP_DIR="/root/karakeep"
   
   mkdir -p $BACKUP_DIR
   
   cd $KARAKEEP_DIR
   docker compose stop karakeep
   tar -czvf $BACKUP_DIR/karakeep_backup_$(date +%Y%m%d%H%M%S).tar.gz ./data docker-compose.yml
   docker compose start karakeep
   
   # Delete old backups (e.g., older than 7 days)
   find $BACKUP_DIR -name "karakeep_backup_*.tar.gz" -mtime +7 -delete

   Make the script executable: chmod +x ~/karakeep/backup.sh.

   Then add it to cron (crontab -e) for daily execution:

   0 3 * * * /root/karakeep/backup.sh > /dev/null 2>&1

   This line will run the script every day at 03:00.
4. Backup storage:

   Never store all backups only on the same server as Karakeep itself. If the VPS fails, you will lose both Karakeep and its backups. It is recommended to use:

   • Remote storage: S3-compatible storage (e.g., Backblaze B2, DigitalOcean Spaces), SFTP server, cloud storage (Google Drive, Dropbox using rclone).
   • Local copying: Regularly download the latest backups to your local computer.

Karakeep Docker Update Process

Karakeep updates bring new features, bug fixes, and most importantly, security enhancements. Since you are using Docker, the update process is very simple:

1. Navigate to the Karakeep directory:

   cd ~/karakeep

2. Stop the current containers:

   docker compose down

3. Download new images:

   docker compose pull karakeep

   (If you are using PostgreSQL, also docker compose pull db, although the database is updated less frequently).
4. Start the containers with the updated images:

   docker compose up -d

5. Check logs for errors:

   docker compose logs karakeep

It is recommended to perform a backup before each update. In case of issues, you can always revert to a previous working version by simply running the old image or restoring data from a backup.

Monitoring Karakeep Status on the Server

Monitoring your VPS and Karakeep allows you to timely identify performance, security, or availability issues. Various tools can be used for this:

• Docker Logs: Regularly review Karakeep container logs: docker compose logs karakeep.
• System Utilities: htop, top, free -h, df -h to monitor CPU, RAM, and disk space usage.
• Uptime Monitoring: Use external services (e.g., UptimeRobot, Healthchecks.io) to check the availability of your Karakeep domain.
• Specialized Monitoring Tools: For deeper analysis, consider installing Netdata. It provides detailed statistics on all aspects of server and container operation. We have a detailed guide on installing Netdata on a VPS.

Regularly checking these metrics will help you prevent problems before they become critical.

Choosing the Optimal VPS Configuration for Karakeep under Real-World Load

Choosing the right VPS configuration for Karakeep self-hosted depends on several factors, including the number of users, usage intensity, and the presence of other services on the same server. Overpaying for excessive resources is as inefficient as suffering from a lack of power.

Factors Influencing VPS Selection for Karakeep

1. Number of Users:
   • 1-5 users: Minimum requirements are usually sufficient.
   • 5-20 users: More RAM and CPU are needed to handle simultaneous requests.
   • 20+ users: Consider more powerful VPS options or even a dedicated server, especially if users actively use the system.
2. Usage Intensity:
   • Infrequent access: If Karakeep is used a few times a day, even a basic VPS will suffice.
   • Frequent access / Automation: If Karakeep is integrated with other systems or used very actively, more resources will be required.
3. Database:
   • SQLite: Suitable for most personal and small teams. Requires fewer resources but can become a bottleneck under very high load.
   • PostgreSQL/MySQL: Recommended for medium to large teams. Requires a separate container and additional RAM (minimum 512 MB - 1 GB just for the database).
4. Other Services on the VPS:

   If other applications are running on your VPS (e.g., a web server for another site, VPN, mail server, Gitea, Linkwarden, or Wallabag), you will need significantly more resources than for Karakeep alone. Always consider the total needs of all applications.

5. Disk Type:

   NVMe/SSD drives are essential for good database performance, especially as the number of secrets and users grows.

Table of Recommended VPS Configurations for Karakeep

Below is a table with recommendations for choosing a VPS configuration from Valebyte.com for various Karakeep use cases. Prices are approximate and may vary.

When choosing a VPS, it's always better to select a plan with a slight surplus of resources to avoid performance issues in the future. Also, consider using a Self-managed VPS if you want full control over your server and are prepared for self-administration.

Security and Optimization Recommendations for Karakeep Self-Hosted

Deploying Karakeep on a server gives you control but also places responsibility for security. Here are some key recommendations.

General Principles for Protecting VPS and Karakeep

1. Use strong passwords and SSH keys: Always use SSH keys for VPS access, not just passwords. Disable password login for the root user.
2. Configure a firewall (UFW/firewalld): Open only necessary ports (22, 80, 443). Close all others.
3. Regularly update OS and Docker: Keep your operating system and Docker up to date to receive the latest security patches.
4. Use HTTPS: As we have already configured, HTTPS (via Nginx/Caddy and Let's Encrypt) encrypts all traffic between your browser and Karakeep.
5. Protect APP_SECRET: This key is critically important. Ensure it is strong and not stored in plain text.
6. Enable two-factor authentication (2FA) for Karakeep: After setting up the first user, be sure to enable 2FA for all accounts.
7. Restrict access to Karakeep (optional): If Karakeep is only needed for a specific group of IP addresses, you can configure firewall rules or Nginx/Caddy to restrict access. For example, in Nginx, you can use the allow/deny directive.
8. Use Fail2Ban: To protect SSH and the web server from brute-force attacks, install and configure Fail2Ban.
9. User separation: Run Karakeep under a non-privileged user if possible, rather than root. In Docker Compose, this can be done using PUID and PGID variables.

Optimizing Karakeep Performance

While Karakeep is not a resource-intensive application, a few tips will help ensure its optimal performance:

1. Use NVMe/SSD drives: This is the most important factor for database performance, especially with a large number of secrets or users.
2. Sufficient RAM: A lack of RAM will lead to active swap usage, which will slow down the system. Monitor RAM usage with free -h or Netdata.
3. Docker Optimization:
   • Ensure Docker uses a modern storage driver (e.g., overlay2).
   • Regularly clean up unused Docker images, containers, and volumes: docker system prune -a.
4. PostgreSQL Configuration (if used):

   If you choose PostgreSQL, it can be further optimized. For example, configure shared_buffers, work_mem, and maintenance_work_mem parameters in the postgresql.conf file, based on the available RAM of your VPS. However, for most small Karakeep installations, the default PostgreSQL settings in Docker will be sufficient.

5. Monitoring: Continuous monitoring will help identify bottlenecks. If you see that CPU or RAM are consistently loaded at 80-90%, it might be time to upgrade your VPS plan or optimize other services running on it.

Conclusion

Karakeep on a VPS is a powerful and secure solution for those seeking full control over their secrets and passwords. By following our detailed guide, you will be able to perform a Karakeep installation using Docker Compose, configure secure access via a Reverse Proxy with HTTPS, and ensure reliable maintenance of your system. For optimal Karakeep performance, we recommend choosing a VPS with at least 2 vCPUs, 2 GB RAM, and an NVMe disk, which will provide stability and performance for most use cases.