跳轉至

Docker Compose

Overview

docker Compose is a tool for defining and running multi-container docker applications. By using a YAML file (typically named docker-compose.yml), users can configure application services, networks, and volumes in a single, version-controlled file. This approach simplifies the orchestration of complex stacks, making it an essential component of modern gitops and self-hosting workflows.

Core Concepts

  • Services: Each container in a stack acts as a service. You can define images, environment variables, dependencies, and network connections here.
  • Networks: Compose automatically creates a default network for your services, allowing them to communicate with each other securely by their service names.
  • Volumes: Persistent storage mappings that ensure data survives container restarts or updates.

Security and secrets-management

In production environments, hardcoding sensitive data like passwords or API keys directly into docker-compose.yml is a significant security risk. For users managing infrastructure on platforms like oracle-cloud or other VPS providers, it is recommended to replace plain-text .env files with dedicated secrets management tools.

Tools like infisical provide a superior alternative, allowing users to inject secrets directly into containers at runtime. This practice, combined with git version control, prevents credentials from being exposed in public or private repositories.

Production Integration

For users deploying stacks via Dockhand or automated pipelines like github-actions, docker Compose serves as the foundation for Infrastructure as Code (IaC). To maintain a secure environment, ensure that all services communicate through isolated internal networks (such as cf_network when using cloudflare-tunnel) and avoid mapping service ports directly to the host machine unless absolutely necessary.

Standard YAML Structure Example

version: '3.8'

services:
  web-app:
    image: example/image:latest
    container_name: web_app
    restart: always
    volumes:
      - /home/opc/data:/data
    networks:
      - cf_network

networks:
  cf_network:
    external: true

Best Practices

  • Container Isolation: Place all related services within the same custom network and rely on cloudflare-tunnel or reverse proxies for external routing.
  • Resource Management: Use deploy.resources to limit CPU and memory usage, ensuring stability on platforms like Oracle Ampere A1 (ARM64) instances.
  • Automation: Utilize tools like n8n or Codex CLI to manage, monitor, and troubleshoot your compose stacks automatically.
  • Persistence: Always map persistent data to host directories to ensure data integrity during container updates or host reboots.

Sources

See Also