DigitalOcean Droplets Explained: Plans, Images, and Networking
DigitalOcean Droplets explained: teams and projects, shared and dedicated CPU plan families, images, snapshots and backups, regions, VPC networking, Droplet limits, billing, and the port 25 policy.
DigitalOcean built its reputation on Droplets, its name for virtual machines, and the platform has grown around them into managed databases, Kubernetes, object storage, and app hosting. This guide explains how a DigitalOcean account is organised, what the Droplet plan families mean, how images and snapshots work, how networking is arranged, and what to check about limits, billing, and email sending before you deploy.
Accounts, teams, and projects
A DigitalOcean account is tied to one login and one payment method. Work is organised inside teams: each team has its own resources, billing, API tokens, and members with role-based permissions. A personal account behaves like a team of one, and you can create additional teams to separate clients or business units. Inviting collaborators into a team is the right way to share access; sharing the account password is not.
Within a team, projects are a labelling layer for grouping Droplets, databases, volumes, and other resources by purpose. Projects do not affect billing or networking; they exist to keep the control panel readable and to set a default destination for new resources.
Access to the API uses personal access tokens scoped to a team, with read or write permission, and newer tokens can be limited to specific scopes. Two-factor authentication is available on every account and should be turned on immediately. The DigitalOcean accounts documentation covers teams, billing, and security settings in detail.
Droplet plans: shared CPU and dedicated CPU
Droplets are grouped into plan families by how CPU is allocated. Shared CPU plans run on hypervisors where physical cores are shared between tenants, which keeps prices low and suits web servers, development boxes, and light services. Dedicated CPU plans reserve physical cores for your Droplet and are meant for sustained workloads.
| Family | CPU model | Typical use |
|---|---|---|
| Basic (Regular, Premium Intel, Premium AMD) | Shared vCPU | Websites, blogs, small APIs, staging, personal projects |
| General Purpose | Dedicated vCPU, balanced memory | Production web applications, e-commerce, small databases |
| CPU-Optimized | Dedicated vCPU, lower memory ratio | CI runners, batch processing, video encoding, game servers |
| Memory-Optimized | Dedicated vCPU, high memory ratio | In-memory caches, large databases, analytics |
| Storage-Optimized | Dedicated vCPU, large local NVMe | Databases and search engines that need fast local disk |
| GPU Droplets | Dedicated GPU | Model training, inference, rendering |
Within each family you pick a size, which fixes vCPU count, memory, local SSD, and monthly transfer allowance. Droplets can be resized upward, and CPU and memory-only resizes can later be reversed, while a resize that grows the disk is permanent. Billing is hourly with a monthly cap, so a Droplet that runs all month costs the listed monthly price and one deleted after a few days costs only those hours. Powered-off Droplets still bill because their disk and IP stay reserved.
Images, snapshots, backups, and Marketplace apps
Every Droplet starts from an image. DigitalOcean maintains base images for Ubuntu, Debian, Fedora, AlmaLinux, Rocky Linux, and other distributions. The Marketplace adds 1-Click images with software preinstalled, such as Docker, WordPress, or a LAMP stack, built by DigitalOcean and partners. You can also upload custom images in common formats to run an operating system that is not in the catalogue.
Snapshots are on-demand copies of a Droplet or volume that you trigger yourself, keep as long as you like, and can use to create new Droplets in any region that supports transfer. Backups are automatic and taken on a schedule, with a fixed retention window, for an added percentage of the Droplet price. Neither replaces an off-platform backup of critical data, but together they cover most operational restores. User data passed at creation runs through cloud-init, which is how teams install packages and configure users without logging in.
Regions and networking
DigitalOcean runs data centers in North America, Europe, Asia, and Australia, with some cities having more than one numbered location (for example NYC1 and NYC3). Regions are independent: a Droplet, a volume, and a VPC all belong to one region, and not every product is available in every region, so check availability before you commit to a location.
Networking is built on VPC. Every region has a default VPC, and Droplets created there receive a private address for traffic between your own resources at no bandwidth charge. You can create additional VPCs to isolate environments. Cloud Firewalls are stateful rule sets applied to Droplets by name or tag, managed outside the operating system, and a good complement to a host firewall. Reserved IPs (previously called Floating IPs) are public addresses you can reassign between Droplets in the same region for failover. Load Balancers distribute HTTP, HTTPS, and TCP traffic across Droplets and handle TLS termination.
Outbound data transfer is pooled across all Droplets in a team, with each Droplet contributing its plan allowance to the pool. Inbound transfer is free. Overage beyond the pool is billed per gigabyte.
Beyond Droplets: the rest of the platform
Most accounts use Droplets alongside at least one managed service:
- Volumes add block storage that attaches to a Droplet in the same region and can be resized upward.
- Spaces is S3-compatible object storage with an optional built-in CDN, suited to uploads, static assets, and backups.
- Managed Databases cover PostgreSQL, MySQL, Redis-compatible caching, MongoDB, Kafka, and OpenSearch with automatic failover options.
- DigitalOcean Kubernetes (DOKS) runs a managed control plane with worker nodes billed as Droplets.
- App Platform builds and deploys from a Git repository or container image without managing servers.
- Functions runs short serverless code triggered by HTTP or schedules.
Droplet limits, email, and practical considerations
Every team has a Droplet limit, the maximum number of Droplets it can run at once. New accounts start with a small limit, and increases are requested from the control panel and reviewed by DigitalOcean based on account history and stated use. Listings described as “3 Droplet” or “10 Droplet” refer to this limit and nothing else. Volumes, reserved IPs, and other resources have separate per-team limits.
Email sending deserves a specific note. DigitalOcean blocks outbound SMTP on port 25 for new accounts by default to control spam, and its published policy explains the conditions under which the block may be lifted on request. Any sending you do must follow the DigitalOcean Acceptable Use Policy and anti-spam law. For most applications, a dedicated email service is the better route. Read the DigitalOcean SMTP policy before you plan around port 25.
- Enable two-factor authentication and create scoped API tokens per tool rather than one master token.
- Set a billing alert in the control panel so you are notified when month-to-date usage crosses a threshold.
- Add your SSH key at Droplet creation and disable password login on the server.
- Apply a Cloud Firewall on day one and open only the ports your application needs.
- Keep workloads within the Acceptable Use Policy; abuse reports, cryptocurrency mining on trial credit, and spam lead to suspension.
Where to go next
Listings labelled by Droplet limit or by outbound port 25 status are on the Buy DigitalOcean Accounts product page.
Related reading in the Cloud Library:
- Cloud service quotas and limits explained
- Port 25 and cloud email sending: why providers restrict it
- Deploying your first cloud server: a practical checklist
- Securing a VPS: firewalls, Fail2ban, and automatic updates
- Object storage vs block storage
Browse the full Cloud Library, or see how DigitalOcean stacks up in the DigitalOcean vs Linode comparison.