k3s is a full CNCF-certified Kubernetes distribution packaged as a single binary under 100 MB, using SQLite as the default datastore and bundling Traefik, CoreDNS, a service load balancer and a local-path storage provisioner. It is maintained by SUSE and is a CNCF sandbox project.
Our verdict on k3s#
Should a homelab run Kubernetes? Mostly no, and k3s does not change that answer, it just lowers the entry fee. The question to ask is what you get for the cost, and the cost is concrete: the control plane holds around 2 GB and never goes fully idle, certificates are valid for 365 days and are only renewed when k3s restarts within 120 days of expiry (so a node that runs uninterrupted for over a year locks you out), the bundled Traefik and ServiceLB are deployed from manifests you must override rather than edit, and the local-path provisioner pins a volume to one node so your "cluster" cannot actually reschedule stateful pods. Against that, a compose file gets you the same three services with none of it. Run k3s if you need Kubernetes skills for work, or if you genuinely have several nodes and want workloads to survive one dying. Current release is v1.36.4+k3s1 (August 2026).
Who k3s is for#
Choose it if
- Someone who needs hands-on Kubernetes for their job and wants a realistic cluster on hardware they already own
- A three-node setup where surviving the loss of one machine is a real requirement, not an aspiration
- An edge or appliance deployment where you want declarative workloads on small ARM boards with a single binary to install
Look elsewhere if
- You run under about ten services on one machine, where docker compose gives you the same result with none of the moving parts
- You want to spend your evenings using your services rather than operating the thing that runs them
- Your storage plan is a single NAS export and you were hoping Kubernetes would make that highly available; it will not
What running it actually looks like#
curl -sfL https://get.k3s.io | sh - installs a systemd service and a single binary, and you have a working cluster in under a minute with a kubeconfig at /etc/rancher/k3s/k3s.yaml. Documented minimums are 2 cores and 2 GB for a server, 1 core and 512 MB for an agent. Agents join with the token from /var/lib/rancher/k3s/server/node-token over TCP 6443, and Flannel needs UDP 8472 open between all nodes, which the docs warn should never face the internet. The install brings Traefik, CoreDNS, ServiceLB, metrics-server, the local-path provisioner and Spegel with it; disable what you do not want with --disable at install time, because removing an add-on later means it gets reapplied. HA needs three servers with embedded etcd and ports 2379 to 2380 between them.
Resource profile#
- Memory
- 2048 MB idle, around 4096 MB in ordinary use. Documented minimums are 2 cores and 2 GB for a server node and 1 core with 512 MB for an agent; the typical figure allows for the bundled add-ons plus a handful of workloads.
- CPU and acceleration
- The control plane is never truly idle: the API server, scheduler and controller manager reconcile continuously, which on a low-power board shows up as a constant few percent of a core plus a warm fan.
- Storage growth
- State lives under `/var/lib/rancher/k3s`, including the SQLite database, TLS material and the containerd image store; the local-path provisioner writes PVC data to `/var/lib/rancher/k3s/storage` on whichever node the pod landed on.
- Operational load
- 4 of 5, Heavy. Version-pinned upgrades tracking upstream Kubernetes, certificates that expire on a clock, add-ons that are managed by manifests you must override rather than edit, and restores that need the datastore and the token together. Rubric level 4.
Figures describe a small single-household install and are the working assumptions behind our stack planner. Your numbers will differ with library size, user count and hardware. See methodology.
Data and backup surface#
Everything that matters is under /var/lib/rancher/k3s/server: db/state.db (the SQLite datastore, or db/etcd for embedded etcd), tls (cluster certificate authorities), token and cred. Stop k3s before copying the SQLite file, or use k3s etcd-snapshot on etcd clusters. Losing token and the CA material means a restored datastore cannot be joined by existing nodes. Persistent volume data written by the local-path provisioner lives in /var/lib/rancher/k3s/storage on each node and is not in the datastore at all, so back it up separately. Container images under agent/containerd are regenerable. Keep your manifests in git; that is the real backup.
Derived backup shape
SQLite backup. sqlite3 <db> ".backup out.db" while running, or stop the container and copy. A live cp of a WAL-mode SQLite file can restore corrupt.
Traps and surprises#
Certificates expire after 365 days
k3s client and server certificates are valid for 365 days and are renewed automatically only when k3s restarts while they are expired or within 120 days of expiry. A node that runs untouched for more than a year comes back after a power cut with an unreachable API server. Restart k3s at least annually, or watch for the CertificateExpirationWarning event that fires at 120 days. Older releases used a 90 day window.
Bundled add-ons are managed and get reapplied
Traefik, CoreDNS, ServiceLB, metrics-server and the local-path provisioner are deployed from manifests in /var/lib/rancher/k3s/server/manifests. Editing the resulting resources with kubectl works until k3s restarts and reconciles them back. The supported approach is a HelmChartConfig override in your own manifest, or --disable traefik at install time. People replacing Traefik with ingress-nginx hit this within a week.
local-path volumes pin pods to one node
The default storage class writes to a directory on whichever node scheduled the pod, so that pod can never be rescheduled elsewhere without losing its data. This makes multi-node k3s look highly available while your database is effectively single-node. If you want workloads to move, you need Longhorn, an NFS provisioner or an external CSI driver, and each of those is a project in its own right.
SQLite is the default and it is not for clusters
A default install uses SQLite via kine, which cannot support multiple server nodes. Adding a second control-plane node later requires migrating to embedded etcd, which means restarting the first server with --cluster-init and is not a live operation. Decide up front: single node on SQLite, or three servers with embedded etcd. Embedded etcd is also unforgiving of slow disks and will flag latency warnings on SD cards.
Upgrades track upstream Kubernetes, not your calendar
k3s follows upstream Kubernetes minor releases, so a version is supported for roughly a year and you cannot skip minors when upgrading. That is three or four upgrade windows a year for a home cluster, each with its own deprecated API removals that can break your manifests. Read the upstream deprecation notes for every minor you cross, and upgrade servers before agents.
Specifications#
- Category
- Platforms and container management
- Licence
- Apache-2.0 (Permissive)
- Written in
- Go
- First release
- 2019
- Maturity
- Mature
- Datastore
- SQLite by default (kine); embedded etcd for HA, or external MySQL or PostgreSQL
- Default ports
6443,8472,10250,51820- Ships as
- curl install script as a systemd service, single binary, k3d in Docker
- arm64 builds
- Yes
- Identity
- Not applicable. Kubernetes authentication is certificates, tokens and OIDC configured on the API server; there is no login page to point at your identity provider.
- Replaces
- Amazon EKS, Google GKE, Docker Swarm
- Project site
- k3s.io
- Source
- github.com/k3s-io/k3s
- Documentation
- docs.k3s.io
Alternatives to k3s#
Everything else in platforms and container management, closest in operational weight first.
| Tool | Ops load | Idle RAM | Licence |
|---|---|---|---|
| Proxmox VE | 4, Heavy | 2048 MB | AGPL-3.0-only |
| Coolify | 3, Moderate | 1200 MB | Apache-2.0 |
| Dokploy | 3, Moderate | 900 MB | Apache-2.0, with DSAL 1.0 reserved for a /proprietary path |
| Komodo | 3, Moderate | 250 MB | GPL-3.0 |
| TrueNAS Community Edition | 3, Moderate | 8192 MB | LGPL-3.0 (middleware) |
| CasaOS | 2, Light | 300 MB | Apache-2.0 |
Sources#
Facts on this page were checked against the project's own material. Where a number is our own estimate rather than a published figure, the text says so.
Published . Last reviewed . Found something out of date? Tell us and we will fix it and log the change.