Docker Compose on a NAT VPS: A Safe Starting Layout

Docker Compose can describe a small multi-container application, but you still need to plan memory, persistent data, guest ports and public NAT mappings. Start with a narrow deployment rather than exposing every container port.

Example loopback-only web service

services:
  web:
    image: nginx:stable-alpine
    ports:
      - "127.0.0.1:8080:80"
    volumes:
      - ./site:/usr/share/nginx/html:ro
    restart: unless-stopped
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

Create site/index.html first. With a working Docker Engine and Compose plugin, validate using docker compose config and start with docker compose up -d. Use a reviewed version or digest for reproducible production deployments; a moving image tag can change over time.

Understand this binding

The published port is bound only to guest loopback. That suits a local reverse proxy or SSH tunnel. A provider NAT mapping normally cannot reach a guest-loopback-only listener. If you intentionally publish to a guest interface, review firewall and authentication requirements first.

Manage changes and data

Check docker compose ps and bounded logs after startup. Plan image updates and test application compatibility. A restart policy does not guarantee application health or database readiness.

Keep secrets out of a public Compose file. Back up persistent volumes consistently. Do not use docker compose down -v casually: it can remove volumes and their data. Understand cleanup commands before running them.

See Docker resource planning, SSH forwarding and backup recovery.

Reference: Compose file services reference.