TrueNAS Apps Catalog in Production: When the Built-in Apps Can Replace Your Second System

The Apps Catalog in TrueNAS is one of those features where we have seen the biggest shift in attitude over the last two years. In 2024, the rule of thumb for most admins was: “Containers on the file server? Never.” With TrueNAS 25.10 Goldeye and an Apps Catalog that has genuinely grown up, that rule now needs more nuance. In small and midsize shops, the built-in apps are increasingly replacing the classic “second system” — usually a small Linux box or a Proxmox VM nobody really wanted to maintain. This article walks through when we recommend the TrueNAS Apps Catalog in production, when we still choose a separate host, and which workloads have actually proven themselves in practice.

What is really inside the TrueNAS Apps Catalog in 2026

Under the hood, TrueNAS Scale 25.04 Fangtooth moved to a Docker-based stack — so no more classic Kubernetes layer like earlier Scale versions, but Docker Compose as the runtime with TrueNAS orchestration on top. For us as a partner, this means that everything in the Apps tab is really just a Linux container that stores its persistent data on a dataset. That makes the whole thing predictable.

The official catalog now ships, among others:

• Nextcloud as a full file platform with Office integration
• Vaultwarden as a self-hosted, Bitwarden-compatible password manager
• Grafana including a Prometheus backend for small monitoring setups
• Jellyfin as a media server (more relevant for practices, clubs, and associations than for industrial SMBs)
• Immich as a smartphone photo backup target
• Paperless-ngx for document-centric workflows
• Authentik as a central identity provider
• AdGuard Home as a DNS filter

On top of that sits the Custom App, which we covered in detail in our article on the TrueNAS App Catalog with your own images. This article is deliberately not about edge cases but about the standard apps in the catalog — and the question of when they can replace a second server in a small or midsize company.

TrueNAS apps for small and midsize shops: when the built-in apps really hold up

Our experience across small and midsize environments is clear: the more an app is tied to the data that already lives on the NAS, the better it fits directly on TrueNAS. The more an app is tied to its own user tier or to an always-on service that others depend on, the more we lean toward a separate host.

Nextcloud running directly on TrueNAS

Nextcloud is our textbook example. The payload lives on a ZFS dataset, snapshots happen through the standard mechanism, and replication to a second TrueNAS or to a hyperscaler’s S3 target works with the established tools. For a standard SMB workload up to a few dozen users, the TrueNAS app gives us a clean separation between payload dataset, config dataset, and database — and we drop the “Nextcloud Linux server on the side” we used to run.

Where we get skeptical: as soon as we expect more than roughly 50 active users, serious Office Online load, or high availability, Nextcloud still tends to end up on dedicated Proxmox VMs with an external database. Horizontal scale and patch cadence simply have more room to breathe there.

Vaultwarden on the NAS — a true sweet spot

Vaultwarden is, from our perspective, the best news the catalog has brought to small and midsize shops. For 10 to 50 employees we no longer need a dedicated VPS, a complex reverse-proxy chain, or a separate database. One dataset for persistent state, one app instance, one TrueNAS snapshot schedule — done. Together with a proper backup setup for Proxmox and TrueNAS we have a password infrastructure we are happy to recommend.

Grafana and small-scale monitoring

For small monitoring stories — server room temperature, backup success, a handful of switch metrics, SMART values — the Grafana app on the NAS is more than enough. The metrics we already export from TrueNAS land, via a few standard exporters, in a small Prometheus instance right next to it.

The setup stops being appropriate as soon as real infrastructure monitoring across multiple sites, SLA reporting, or audit requirements come into play. At that point DATAZONE builds a dedicated monitoring stack on a separate host — deliberately away from the file server, so a NAS outage does not also take our monitoring view down with it.

Jellyfin and Immich — for practices, clubs, and niche cases

For classic industrial SMBs, Jellyfin and Immich are not core apps. For dental practices with photo documentation, for photo studios, or for club archives they absolutely are. In these cases, running them directly on the NAS makes sense: the media data does not have to travel over the network to a separate host.

Authentik and AdGuard Home — when in doubt, run them separately

Here we get careful. Authentik as an identity provider and AdGuard Home as a DNS resolver are services that other things depend on. If the file server goes down and takes the identity provider with it, suddenly nobody can log in anywhere. If the DNS resolver dies, half the network goes dark.

So our clear recommendation: services other infrastructure depends on belong on separate hosts — or redundantly on two systems — but not exclusively on the NAS whose primary job is storing files.

When we still recommend a separate server

A few signals make us raise a finger in conversations with customers:

• High availability and failover. TrueNAS HA is storage HA, not service HA for apps. If you need an active-active Nextcloud, you really want two Proxmox hosts and proper load balancing.
• Service SLAs with patch windows outside storage maintenance. We want to patch the file server on the weekend and the apps during the week at night. Those are two rhythms that only partly match on a single host.
• Heavy compute in apps. Transcoding, big-data jobs, OCR pipelines pull CPU load we would rather keep away from the file server.
• Audit and compliance separation. For some industries — law firms, tax advisors, healthcare — a clean split between “file storage” and “application layer” is not only a technical point but also a regulatory one.

In those cases we put a Proxmox host next to the NAS. The hardware can still be planned through the familiar TrueNAS configurator, even if the host runs Proxmox and the NAS “only” serves as backend storage over iSCSI or NFS. If you are unsure, our TrueNAS support can review hardware sizing and licensing before anything hits the rack.

Snapshots, backup, and updates with apps on TrueNAS

The real reason apps on the NAS have become so attractive is the ZFS backend. If we put the apps configuration and the app data on dedicated datasets, we get snapshots, replication, and encryption essentially for free.

Our proven layout:

• tank/apps — Docker root and image layers, LZ4 compression, no aggressive snapshots
• tank/appdata/<app>/config — configuration, 16K recordsize, hourly snapshots, 7 days retention
• tank/appdata/<app>/data — payload and databases, 64K recordsize, daily snapshots, 30 days retention

What we do not do: treat TrueNAS’s app snapshots as our only backup. Snapshots protect against user error and single software bugs. They do not protect against an encrypted replication or the loss of the entire pool. For that reason, replication to a second target always runs in parallel — either to a second TrueNAS in a different fire zone or, as described in our article on TrueNAS replication to a hyperscaler S3 target, to an immutable object store.

For update cadence the rule remains: app updates have their own rhythm, TrueNAS updates have another. Before a major TrueNAS release — and that is TrueNAS 27 GA in early December 2026 for us — we always re-read the release notes of the apps in use and we always take a full pool snapshot before the upgrade. For production environments, the recommendation stays the same: do not jump on the new major on day one; continue on the proven 25.10 Goldeye path until TrueNAS 27 has one or two patch releases behind it.

When the NAS is too small: sizing hardware honestly

Containers eat RAM. Not as much as a full VM, but more than we would have planned for a pure file server. Our rule of thumb for small and midsize setups with apps:

• Pure file server use follows the classic TrueNAS RAM guidance
• For three to five standard apps, plan 16 to 32 GB on top
• Nextcloud with Office Online integration starts at 32 GB on top
• CPU headroom: two to four extra threads depending on app mix

In practice this usually means a TrueNAS M30 or M40 from the current iXsystems portfolio is the honest starting line once the catalog is going to be used actively. The EOL models M50 and M60 are no longer our recommendation for new customers. Mini systems like the Mini R are a fit for very small environments and outsourced branches — our article on the TrueNAS Mini R for home office and remote sites covers that in more detail.

Pricing for the systems above is available on request, because hardware and licensing conditions move quickly right now. We only hand out binding numbers inside an actual project with configuration and support level attached.

FAQ: TrueNAS Apps Catalog in production

Is the Apps Catalog in TrueNAS 25.10 Goldeye ready for production use?

Yes. For standard workloads like Nextcloud, Vaultwarden, Grafana, or Paperless-ngx we treat the catalog as production grade. The deciding factors are a clean separation of configuration and data on dedicated datasets and a backup strategy that goes beyond snapshots.

Does the Apps Catalog always replace a separate Proxmox host?

No. For highly available services, workloads with heavy CPU load, and services that other infrastructure depends on — identity, DNS, central monitoring — we still recommend a separate host. In practice the Apps Catalog very successfully replaces the “second little Linux system on the side”, but not a dedicated virtualization platform.

What happens to my apps when upgrading to TrueNAS 27?

TrueNAS 27 ships early December 2026 as GA. iXsystems has announced that the existing 25.10 apps format will carry over seamlessly. Our rule stays the same: pool snapshot before the upgrade, wait for the first patch release, document the rollback path. For production SMB environments we recommend staying on 25.10 Goldeye until the first or second 27.x patch is out.

How do I back up my app data properly?

Configuration and data datasets belong in a replicated snapshot strategy. On top of that, a replication to a second, physically separated system or to an immutable object store. Local snapshots alone are not a backup — they are a comfort feature against user error.

Can I run my own containers from the catalog?

Yes. The Custom App function lets you deploy your own Docker images from a private registry or Docker Hub. We cover the details in our article on the TrueNAS App Catalog with your own images.

How do I start if my NAS is only serving files today?

Start with one small app to learn with — Vaultwarden is ideal for that — and a clear dataset layout from day one. The more application-heavy apps come next. If you want a second pair of eyes, our IT service team or TrueNAS support can walk through the target architecture in a short workshop before the first production workload moves over.