{"id":85691,"date":"2026-07-10T07:00:00","date_gmt":"2026-07-10T14:00:00","guid":{"rendered":"https:\/\/dhblog.dream.press\/blog\/?p=85691"},"modified":"2026-07-10T07:00:14","modified_gmt":"2026-07-10T14:00:14","slug":"debian-12-vs-debian-13-vps","status":"publish","type":"post","link":"https:\/\/www.dreamhost.com\/blog\/debian-12-vs-debian-13-vps\/","title":{"rendered":"Debian 12 vs. Debian 13 on a VPS: Which To Pick in 2026"},"content":{"rendered":"
\n\t
\n\t\t\n\t\n\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t\t\n\t\t<\/g>\n\t\t\n\t<\/g>\n<\/svg>\n\t<\/div>\n\t
\n\t\t\n\n

Debian is a community-run Linux distribution built for stability, with conservative package versions, the smallest install footprint of any mainstream server OS, and roughly five years of support per release. <\/p>\n\n\n\n

Debian 13 (Trixie)<\/strong>, released August 2025, is the recommended default for new VPS deployments in 2026, with combined Security + LTS support through June 30, 2030. <\/p>\n\n\n\n

Debian 12 (Bookworm)<\/strong>, released June 2023, completed full Debian Security team support on July 11, 2026, and is now covered by the Debian LTS team through June 2028.<\/p>\n\n\n\n

Debian is the right call for production web servers, Docker hosts (the debian:bookworm-slim<\/strong> and debian:trixie-slim<\/strong> images are the de facto container bases), databases, mail, and anything else where boring is a feature.<\/p>\n\n\n\t<\/div>\n<\/div>\n\n\n

Bookworm. Bullseye. Jessie. Sarge. Woody. Potato.<\/em><\/p>\n\n\n\n

Every Debian release going back to 1996 is named after a Toy Story character. Debian’s project leader at the time, who happened to work at Pixar \u2014 started slipping the codenames in, and nobody since has decided to stop.<\/p>\n\n\n\n

The distribution draws its release names from a Pixar franchise older than half of its current maintainers, and is still going strong more than thirty years later.<\/p>\n\n\n\n

That tells you something about Debian\u2019s priorities.<\/p>\n\n\n\n

The Debian Project does not chase the news cycle. It has no marketing team. It has no parent company. It can\u2019t pivot, get acquired, or change its commercial terms, because there are no commercial terms to change.<\/p>\n\n\n\n

It ships a release when the release is ready, and then that release sits on a virtual private server (VPS) doing exactly what you provisioned it to do for the next five years.<\/p>\n\n\n\n

That\u2019s the entire pitch, really. Debian is the Linux you choose when you’d rather not think about your operating system again.<\/p>\n\n\n\n

The only interesting question \u2014 and the one we\u2019re here to answer \u2014 is whether to pick the proven release (Debian 12) or the current one (Debian 13).<\/p>\n\n\n\n\n\n

\n\t\n\t\t<\/svg>\n\t\t<\/span>\n\t\t<\/svg>\n\t<\/a>\n

Linux<\/h3>\n

Linux refers to a collection of open-source Operating Systems (OS). There\u2019s no single Linux OS. Instead, users can choose from a broad group of Linux distros, all of which provide different experiences.<\/p>\n \n Read More <\/a>\n\n<\/div>\n\n\n\n

What Makes Debian Different From Ubuntu and AlmaLinux?<\/h2>\n\n\n\n
\"Debian<\/figure>\n\n\n\n

Debian is a community-governed Linux distribution with no commercial owner anywhere in the supply chain.<\/p>\n\n\n\n

The Debian Project is run by its developers and funded as a non-profit through Software in the Public Interest. Nobody owns Debian, which means nobody can sell it, change its license, or pivot the roadmap.<\/p>\n\n\n\n

That structural fact drives everything Debian is known for.<\/p>\n\n\n\n

It\u2019s conservative by design<\/strong>. When a package goes into a stable release, it stays at that version for the life of the release in all but rare, security-team-approved exceptions \u2014 fixes are backported instead.<\/p>\n\n\n\n

It\u2019s lean.<\/strong> A cold-booted Debian 12 or 13 server install lands around 100 MB of RAM, lower than both Ubuntu Server and AlmaLinux, which typically idle in the 150\u2013200 MB range. That headroom goes to your actual workload.<\/p>\n\n\n\n

It\u2019s the foundation everything else is built on.<\/strong> Ubuntu, Kali, Proxmox VE, and Raspberry Pi OS all derive from Debian. So do the de facto Docker base images for production containers: debian:bookworm-slim<\/strong> and debian:trixie-slim<\/strong>.When you run Debian on a VPS<\/a>, you\u2019re running the same OS that’s already inside most containers on most servers on the internet.<\/p>\n\n\n\n

Support runs roughly five years per release <\/strong>\u2014 about three years from the Debian Security team, then two more from the Debian LTS team<\/a>, with an optional Extended LTS layer beyond that if you need it.<\/p>\n\n\n\n

Debian 12 vs. Debian 13: Which Version Should You Pick?<\/h2>\n\n\n\n
\"Timeline<\/figure>\n\n\n\n

For any new VPS deployment in 2026, pick Debian 13 (Trixie). Pick Debian 12 (Bookworm) only if you have a specific reason to match an existing production server’s toolchain. On a DreamHost self-managed VPS, you’ll provision Debian 13 directly; choose Debian 12 only on platforms where you control the image.<\/p>\n\n\n\n

Debian 12 (Bookworm) <\/strong>shipped in June 2023 with Linux kernel 6.1, Python 3.11, PHP 8.2, and PostgreSQL 15. Full security support ended July 11, 2026; the Debian LTS team now carries security updates through June 30, 2028. Existing Bookworm servers running cleanly don’t need to be rebuilt. The package set is mature, the corners are well-documented, and the migration story to Debian 13 via apt full-upgrade<\/strong> is supported.<\/p>\n\n\n\n

Debian 13 (Trixie)<\/strong><\/a> shipped in August 2025 with kernel 6.12 LTS, Python 3.13, PHP 8.4, PostgreSQL 17, and APT 3.0. Combined Security + LTS coverage runs through June 30, 2030. Phoronix benchmarks measured roughly 13% better performance on AMD EPYC<\/a> against Debian 12 across mixed workloads, mostly attributable to the newer kernel and the GCC 14 toolchain.<\/p>\n\n\n\n

Factor<\/strong><\/th>Debian 12 (Bookworm)<\/strong><\/th>Debian 13 (Trixie)<\/strong><\/th><\/tr><\/thead>
Released<\/td>June 2023<\/td>August 2025<\/td><\/tr>
Linux kernel<\/td>6.1<\/td>6.12 LTS<\/td><\/tr>
Python<\/td>3.11<\/td>3.13<\/td><\/tr>
PHP<\/td>8.2<\/td>8.4<\/td><\/tr>
PostgreSQL<\/td>15<\/td>17<\/td><\/tr>
APT version<\/td>2.6<\/td>3.0 (Solver3)<\/td><\/tr>
Full security support ends<\/td>June 2026<\/td>August 2028<\/td><\/tr>
LTS support ends<\/td>~June 2028<\/td>June 30, 2030<\/td><\/tr>
Default for new VPS in 2026?<\/td>No<\/td>Yes<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Pick Debian 13 if you’re starting fresh, want the longer support runway, or need the newer toolchain versions. Pick Debian 12 if you’re cloning a working production server, running software validated only against Bookworm, or working inside an organization that hasn’t approved Trixie yet.<\/p>\n\n\n\n

Plenty of teams have stayed on Bookworm for 18 months past Trixie’s release to keep their puppet manifests unchanged, and that was the right call for them.<\/p>\n\n\n\n

The in-place upgrade path between releases works, but provisioning a new VPS directly on Debian 13 is less work than upgrading in place on production.<\/p>\n\n\n\n

How Much RAM and Disk Does Debian Need on a VPS?<\/h2>\n\n\n\n

Officially, Debian’s minimum for the graphical installer is 780 MB of RAM and 1160 MB of disk. With swap enabled, the installer technically completes on as little as 350 MB<\/a>. Those are floor numbers \u2014 don\u2019t plan around them.<\/p>\n\n\n\n

In practice, a cold-booted Debian 12 or 13 server uses around 100 MB of RAM, leaving the rest of your VPS for your actual workload. A 1 GB VPS gives you roughly 900 MB for the application after the OS loads. That\u2019s comfortable for a small web app, a personal Mastodon instance, a low-traffic mail server, or a couple of lightweight containers.<\/p>\n\n\n\n

Disk is similarly lean. A clean install consumes a bit over 1 GB. Budget 10 GB total for the OS partition once package caches, log files, and the journal have had a few months to breathe.<\/p>\n\n\n\n

Here\u2019s a practical starting point for sizing:<\/p>\n\n\n\n

Workload<\/strong><\/th>Recommended RAM<\/strong><\/th>DreamHost Plan<\/strong><\/th><\/tr><\/thead>
Web + database on one box, multi-container Docker host<\/td>4 GB<\/td>Stack 4 (recommended baseline)<\/strong><\/td><\/tr>
Production database + app + sync service together<\/td>8 GB<\/td>Stack 8<\/td><\/tr>
Heavy multi-tenant workload, large database, CI runner<\/td>16 GB+<\/td>Stack 16<\/td><\/tr>
Large production workload, memory-intensive database, analytics platform, or multiple services<\/td>32 GB<\/td>Stack 32<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Based on what we see across DreamHost VPS deployments, Stack 4 (4 GB RAM) is the sweet spot for most setups. Debian’s footprint leaves so much room that your workload, not the OS, determines when you need to scale up. Move to Stack 8 when you’re running a database, a web server, and an application simultaneously and want each one to have breathing room.<\/p>\n\n\n\n

One last thing worth calling out: NVMe storage matters even when disk capacity doesn\u2019t. Package installs, container layer extraction, and database fsync calls all live on disk I\/O, and NVMe is roughly five to ten times faster than SATA on small-block random reads and writes. It\u2019s the kind of thing you don\u2019t notice until you\u2019re on a server without it.<\/p>\n\n\n\n

How Do You Set Up a Debian VPS?<\/h2>\n\n\n\n

Six steps cover the first hour after a fresh Debian install. Do them in order: hostname, sudo user, SSH, firewall, automatic security updates, DNS. Debian will largely take care of itself from there.<\/p>\n\n\n\n

\"First-hour<\/figure>\n\n\n\n

1. Set the Hostname<\/h3>\n\n\n\n
sudo hostnamectl set-hostname your-server-name<\/code><\/pre>\n\n\n\n
The hostname shows up in logs, shells, and any monitoring you add later. Pick something descriptive. You’ll thank yourself when you\u2019re managing three VPSes at once.<\/p>\n\n\n\n
2. Create a sudo User<\/h3>\n\n\n\n
sudo adduser deploy\nsudo usermod -aG sudo deploy<\/code><\/pre>\n\n\n\n
Don\u2019t run a production server day-to-day as root. The sudo<\/code><\/strong> group on Debian grants full root access via sudo<\/code><\/strong> with a password prompt, which is the right default. After this step, log out of root and log back in as deploy<\/code><\/strong>.<\/p>\n\n\n\n
3. Lock Down SSH<\/h3>\n\n\n\n
Copy your public key first:<\/p>\n\n\n\n
ssh-copy-id deploy@your-server-ip<\/code><\/pre>\n\n\n\n
Then, disable password authentication and root login by dropping a config file into \/etc\/ssh\/sshd_config.d\/<\/strong>:<\/p>\n\n\n\n
# \/etc\/ssh\/sshd_config.d\/99-hardening.conf\nPasswordAuthentication no\nPermitRootLogin no<\/code><\/pre>\n\n\n\n
Reload the SSH<\/a> daemon:<\/p>\n\n\n\n
sudo systemctl reload ssh<\/code><\/pre>\n\n\n\n
Before you close your current terminal, confirm you can still log in from a second one. Every server admin has a story about why this step matters.<\/p>\n\n\n\n
4. Enable a Firewall<\/h3>\n\n\n\n
The simplest path is ufw (Uncomplicated Firewall), which manages the firewall in two commands.<\/p>\n\n\n\n
sudo apt install ufw\nsudo ufw allow 22\/tcp\nsudo ufw allow 80\/tcp\nsudo ufw allow 443\/tcp\nsudo ufw enable<\/strong><\/code><\/pre>\n\n\n\n
If you’d rather configure nftables directly, it comes pre-installed, and the Debian wiki has a current example config. Either way, the firewall<\/a> should default-deny and explicitly open only the ports you need.<\/p>\n\n\n\n\n\n
\n\t\n\t\t<\/svg>\n\t\t<\/span>\n\t\t<\/svg>\n\t<\/a>\n    
Firewall<\/h3>\n    
A firewall is a set of rules that governs incoming and outgoing connections for a network or a specific device. The goal of firewalls is to protect against intrusions and unwanted outgoing connections.<\/p>\n            \n                            Read More                    <\/a>\n\n<\/div>\n\n\n\n
5. Turn on Automatic Security Upgrades<\/h3>\n\n\n\n
This is the single most underrated Debian feature for VPS deployments \u2014 and one of the first things we recommend enabling on any DreamHost VPS. The Debian Security team ships fixes for high-profile CVEs fast \u2014 often within a day or two for coordinated disclosures \u2014 and unattended-upgrades applies them automatically while you’re not paying attention.<\/p>\n\n\n\n
sudo apt install unattended-upgrades\nsudo dpkg-reconfigure -plow unattended-upgrades<\/strong><\/code><\/pre>\n\n\n\n
Select “Yes” at the prompt. Confirm it\u2019s running with systemctl status unattended-upgrades<\/code>. That\u2019s it \u2014 Debian patches itself overnight as advisories ship.<\/p>\n\n\n\n
6. Point a Domain at the VPS<\/h3>\n\n\n\n
In your DNS provider, add an A record for your VPS\u2019s IPv4 address and an AAAA record for the IPv6 address if you have one. Wait a few minutes for propagation, then run ping yourdomain.com<\/strong> from the VPS to confirm everything is resolved correctly.<\/p>\n\n\n\n
When Should You Use Debian on a VPS?<\/h2>\n\n\n\n
Debian is the right pick for any workload where you want the OS to disappear into the background and stay there. That covers most of what people actually run on VPSes.<\/p>\n\n\n\n
Pick Debian for:<\/strong><\/p>\n\n\n\n