Host container applications on a VPS

Use a maintained container engine and reviewed images. Containers do not remove the need for operating-system updates, persistent storage and backups.

Steps

1. Install a supported container engine and Compose plugin from its official package source. Protect daemon access: it can confer host-level privileges.

2. Select reviewed image versions. Configure an unprivileged application user when the image supports it; avoid privileged mode and mounting the host daemon socket.

3. Store secrets outside version control. Plan persistent volumes for databases and uploads using the image’s documented data paths before starting production.

4. Publish the application port on loopback only. If both services share a container network, route to the service name without a public port mapping.

   services:
     app:
       image: your-registry/your-app:release-tag
       restart: unless-stopped
       env_file: .env
       ports:
         - "127.0.0.1:3000:3000"

5. This excerpt is not a complete stack: replace the image, configure its required variables and data volumes, and make the application listen on the container interface. Loopback on the host is not loopback inside the container.

6. Validate the complete configuration without printing secrets, start it, and check health.

7. Test restart and backup restoration before relying on the service. Removing volumes can destroy persistent data; do not use volume-removal flags for routine updates.

   docker compose config --quiet
   docker compose up -d
   docker compose ps

Check the result

Confirm the intended host listener and firewall behavior, including provider firewall rules. Published container ports may bypass some host firewall rules. Keep database ports private and use a supported engine version.

Related articles

• Monitor a VPS
• Updates and firewall

Last reviewed

2026-10-28