Docker Hosting on a VPS, Set Up Properly

Docker makes an application portable: the same image runs on your laptop, in CI and on the server. It does not make a server production-ready by itself. Someone still needs to set up TLS, persistent storage, log limits, restarts, backups and a deployment process.

Our VPS plans include root access and free DevOps support, including Docker deployment help. For many applications, Docker Compose on one well-run VPS is simpler and cheaper than a cluster. When you outgrow it, see Kubernetes management or AWS.

A production-minded Compose file

This example shows the details that separate a working Compose file from a reliable one: a pinned image tag, a localhost-only port, a health check, log limits and a database that must be healthy before the application starts.

services:
  app:
    image: ghcr.io/your-org/your-app:1.4.2
    restart: unless-stopped
    env_file: .env
    ports:
      - "127.0.0.1:3000:3000"
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:3000/health"]
      interval: 30s
      timeout: 5s
      retries: 3
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    depends_on:
      db:
        condition: service_healthy

  db:
    image: postgres:16
    restart: unless-stopped
    environment:
      POSTGRES_PASSWORD_FILE: /run/secrets/db_password
    secrets:
      - db_password
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 10s
      retries: 5

volumes:
  pgdata:

secrets:
  db_password:
    file: ./secrets/db_password.txt

A Docker gotcha: published ports can bypass your firewall

Docker manages its own firewall rules. A container published with -p 8080:80 can be reachable from the internet even if your UFW rules say otherwise. The safest pattern is to bind application ports to 127.0.0.1, as above, and expose only the reverse proxy.

server {
  listen 443 ssl;
  server_name app.example.com;
  # ssl_certificate lines managed by certbot

  location / {
    proxy_pass http://127.0.0.1:3000;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
  }
}