Apache Solr

Last reviewed Sep 13, 2026 · 800 words

Under about a million documents, Apache Solr is the wrong tool for a self-hoster, and the right tools are Meilisearch or Typesense, which index in minutes and need no schema ceremony. Solr earns its 1 GB minimum and its "Hard" rating in exactly two situations: an application you already run demands a Solr backend, or you need faceted search over a corpus large enough that the difference between Lucene tuned by hand and Lucene tuned by defaults is measurable. Everything below assumes you have checked which of those you are.

The apps that will hand you a Solr requirement

You rarely choose Solr; something chooses it for you. Dovecot's full-text search plugin has a fts_solr backend, so a self-hosted mail server with fast body search often ends up running Solr next to it. CKAN, the open-data portal, requires it. Drupal's Search API Solr module is the standard choice for large Drupal sites. Institutional repositories like DSpace and the Blacklight discovery layer used by libraries are built around it. Apache Nutch, the crawler, feeds it. If you are here because one of those said "install Solr", the rest of this guide is for you. If you are here because you want search for your own app, go read the Elasticsearch vs Meilisearch comparison first; the same reasoning applies to Solr, which shares Lucene with Elasticsearch and shares its operational weight.

One node, standalone mode, and never SolrCloud at home

Solr has two personalities. Standalone mode is one Java process with cores on local disk. SolrCloud is a cluster with ZooKeeper coordinating shards and replicas, and it exists for workloads that need to survive node loss under load. At home or in a small business, SolrCloud triples the moving parts for zero benefit; a single standalone node with nightly backups of the data directory is the correct shape. The official Docker image makes the standalone case one line:

docker run -d --name solr -p 127.0.0.1:8983:8983 \
  -v solr-data:/var/solr solr:9 solr-precreate mail

Port 8983 is the admin UI and the API on the same listener. Bind it to localhost, as above, and let the consuming application reach it over the Docker network or a reverse proxy with authentication in front.

No authentication out of the box

A fresh Solr accepts any request from anyone who can reach the port, including deleting every document in a core with a single POST. This is by design; security is configured through a security.json that enables basic auth and rule-based authorisation, and the official securing Solr documentation walks through it. The pattern that avoids most trouble is simpler: never expose 8983 beyond the host, and treat the consuming app as the only client. If you must reach the admin UI remotely, put it behind your proxy's auth, not on the internet.

Heap sizing is the one tuning knob that matters

The default JVM heap is 512 MB, which is fine for a few hundred thousand mail messages and wrong for a few million documents with faceting. Set SOLR_HEAP (for example SOLR_HEAP=2g) rather than fiddling with garbage-collector flags, and leave the rest of the machine's RAM unallocated so the operating system can cache index files, which Lucene relies on far more than heap. A box with 4 GB total, 2 GB heap and the index on an SSD will outperform 8 GB of heap on spinning disk. Watch the admin UI's memory graph for a week before changing anything else.

Licensing and longevity are the quiet argument for Solr

Solr has been Apache-2.0 since 2006 and is run by the Apache Software Foundation, so it cannot be relicensed out from under you, which is not something Elasticsearch users could say through the 2021 licence change. OpenSearch and Elasticsearch are both more fashionable and have larger communities; Solr is the one whose 20-year-old deployments still upgrade cleanly. For a search backend you expect to run for a decade behind an institutional app, that stability is the feature.

What I'd do

If an application I run requires Solr, I would run exactly one standalone node in Docker, bound to localhost, heap set to a quarter of the box's RAM, data volume backed up nightly with the rest of the stack, and I would never open the admin port. If nothing requires it, I would not install it; Meilisearch for a small site and Typesense when I need typo-tolerant faceting at speed, both covered in the search category. Solr is a fine piece of infrastructure and a poor hobby.