DigitalOcean Droplets: Sizing, Networking and What You Actually Get

DigitalOcean built its reputation on removing decisions. A Droplet is a virtual machine. It has a size, a region, an image and a public IP address. You get root. That is most of the mental model, and for a great many workloads it is enough.

The nuance worth understanding is in the plan types, how bandwidth is billed, and which managed services are worth reaching for instead of self-hosting.

Droplet plan types

Choosing the wrong plan type is the most common and most expensive DigitalOcean mistake.

Shared-CPU Droplets are genuinely fine for intermittent workloads, and genuinely bad for anything that pins a core for minutes at a time. If your application has a steady CPU floor rather than occasional spikes, a dedicated plan is the correct answer even though it looks more expensive per month.

Bandwidth is pooled, which changes the maths

Every Droplet includes a monthly outbound transfer allowance, and — importantly — those allowances pool across the account. Ten Droplets each with 1 TB gives you 10 TB to spend across the whole account, not 1 TB each.

Inbound traffic is free. Traffic over the private VPC network is free. Only outbound public traffic counts against the pool.

This is why account size is often described by Droplet count: it correlates directly with the pooled bandwidth allowance as well as with compute. An environment described by a specific Droplet count tells you about the transfer budget as much as the CPU.

Networking: VPC, Reserved IPs and firewalls

Every region gives you a default VPC. Droplets in the same VPC talk over private addresses with no bandwidth charge and no exposure to the public internet. Putting your database on the private interface only, and reaching it from the application Droplet over the VPC, is the single highest-value configuration change most people can make.

Reserved IPs (previously Floating IPs) are static addresses you can remap between Droplets, which is how you do a zero-downtime cutover without touching DNS TTLs.

Cloud Firewalls are stateful and applied by tag rather than per machine. Tagging Droplets and attaching firewall rules to the tag scales far better than editing rules per host.

SMTP and outbound port 25

New DigitalOcean accounts have outbound port 25 blocked by default, as do most providers. This is an anti-abuse measure, and it is worth understanding rather than working around.

For almost all applications the right answer is a dedicated transactional email service over port 587 or 465 with proper SPF, DKIM and DMARC records. Running your own mail transfer agent means owning deliverability, reputation and compliance yourself — a significant ongoing commitment. Where direct SMTP is genuinely required, it needs to be paired with correct authentication records and lawful, consent-based sending practice. The guide to SMTP and deliverability covers what that involves in practice.

Managed services worth using

• Spaces — S3-compatible object storage with a built-in CDN. Serving static assets from Spaces instead of the Droplet's disk removes both load and bandwidth from the machine.
• Managed Databases — PostgreSQL, MySQL, Valkey/Redis and MongoDB with automated backups, failover and version upgrades. Usually worth the premium over self-hosting once the data matters.
• Volumes — block storage you can detach and reattach, which is how you separate the data lifecycle from the machine lifecycle.
• Load Balancers — managed, with health checks and certificate handling.
• App Platform — a managed PaaS layer for teams who would rather not administer servers at all.

Snapshots and automated backups are separate features with different costs and behaviours. Backups are scheduled and retained on a rolling window; snapshots are manual, permanent until deleted, and portable across regions. Both are covered in more depth in the backup strategy guide.

Where DigitalOcean fits, and where it does not

It fits developer-led teams, small to mid-sized production workloads, agencies running many client sites, and anyone who values predictable flat pricing over granular optimisation. The documentation is genuinely good, which matters more than it sounds.

It fits less well where you need a deep managed-service catalogue, specialised compliance certifications, or very large single-instance sizes. Those needs push towards a AWS account or Azure account. For raw price-to-performance on bare compute in Europe, a Hetzner account will typically win — a trade-off examined in the DigitalOcean and Linode comparison.

Frequently asked questions

Is a Droplet count a meaningful way to describe capacity? It is meaningful for pooled bandwidth and for how many separate machines you can run, but it says nothing about size. Always confirm the plan type and specification alongside the count.

Does destroying a Droplet delete its backups? Backups are tied to the Droplet and are removed with it. Snapshots are independent and persist until you delete them.

Can Droplets in different regions use the same VPC? No. VPCs are regional. Cross-region private traffic requires your own tunnel.

Is the shared-CPU plan enough for a production site? For a low-traffic site with bursty load, often yes. For anything with a sustained CPU floor, move to a dedicated plan.

The Buy DigitalOcean Account listing states the Droplet counts and configurations currently available, including whether outbound port 25 is open on a given environment.