Docker Compose Security for Solo Founders: Exposed Ports, Secrets, and Defaults

The Default Docker Compose is a Security Hole

When you ask an AI tool to generate a Docker Compose file, the output is optimized for local development convenience, not production security. The AI generates port mappings so you can access everything from your browser, uses simple passwords so the setup works immediately, and puts everything on the default network.

This is fine on localhost. But when you copy the same file to a VPS and run docker compose up -d, every mapped port is now publicly accessible on the internet. According to Shodan's 2024 data, over 900,000 PostgreSQL instances are exposed on the public internet, and 12,000+ Redis instances are accessible without authentication. Many of these are Docker containers running with default configurations.

The Sysdig 2024 Cloud Security report found that 75% of container security incidents involve misconfigured access controls - not sophisticated exploits, just default passwords and exposed ports.

The Three Critical Flaws

Flaw 1: Exposed Database Ports

// ❌ BAD - Database accessible from the internet on port 5432
services:
  postgres:
    image: postgres:15
    ports:
      - "5432:5432"    # Anyone on the internet can connect
    environment:
      POSTGRES_PASSWORD: postgres

  redis:
    image: redis:7
    ports:
      - "6379:6379"    # Redis has no auth by default

// ✅ GOOD - No external ports, internal network only
services:
  postgres:
    image: postgres:15
    # No 'ports' - only accessible from other containers
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}  # From .env file
    networks:
      - internal

  redis:
    image: redis:7
    command: redis-server --requirepass ${REDIS_PASSWORD}
    # No 'ports' - only accessible from other containers
    networks:
      - internal

  api:
    build: .
    ports:
      - "3000:3000"    # Only the API is publicly accessible
    networks:
      - internal

networks:
  internal:
    driver: bridge

Flaw 2: Default Passwords

AI tools generate passwords like postgres, password, admin, or changeme. Bots scan for exactly these credentials. If your database port is exposed, it will be compromised within minutes.

// ❌ BAD - Hardcoded default passwords
environment:
  POSTGRES_PASSWORD: postgres
  REDIS_PASSWORD: password
  MONGO_INITDB_ROOT_PASSWORD: admin123

// ✅ GOOD - Strong passwords from .env file (not committed to git)
environment:
  POSTGRES_PASSWORD: ${DB_PASSWORD}
  REDIS_PASSWORD: ${REDIS_PASSWORD}

// .env (add to .gitignore!)
DB_PASSWORD=kP9$mN2xL7#qR4wE8vB1
REDIS_PASSWORD=hJ6&tF3yK9@pW5sA2mC8

Flaw 3: No Network Isolation

By default, all services in a Docker Compose file share a single network. This means if one service is compromised, the attacker has direct access to every other service. Create separate networks for public-facing services and internal services.

Production Docker Compose Checklist

Before deploying your Docker Compose file to a VPS, check every item:

1. Remove all database port mappings - PostgreSQL, Redis, MongoDB, MySQL should have no ports: section
2. Use strong passwords from .env - generate 20+ character passwords with symbols
3. Add .env to .gitignore - never commit secrets to Git
4. Create a .env.example - document required variables without real values
5. Pin image versions - use postgres:15-alpine, not postgres:latest
6. Add health checks - every service should have a healthcheck: block
7. Set resource limits - add mem_limit and cpus to prevent one container from starving others
8. Use a reverse proxy - Caddy, Nginx, or Traefik in front of your app for HTTPS termination
9. Enable restart policies - restart: unless-stopped for production services

Tools like VibeDoctor (vibedoctor.io) scan your Docker configuration for exposed ports, default passwords, unpinned image tags, and missing health checks, flagging exactly what needs to change before you deploy. Free to sign up.

FAQ