docker-compose-production

Use read-only filesystems, drop all Linux capabilities, run containers as non-root users, and store credentials in Docker secrets instead of environment variables. Isolate databases on internal networks and only expose required ports through a reverse proxy like Nginx.

Define a healthcheck block per service with a test command, interval, timeout, retries, and start_period. Use depends_on with condition: service_healthy so dependent services only start after databases and caches report ready.

Use Docker secrets mounted as files under /run/secrets rather than environment variables, which can leak through logs and process inspection. Reference secrets in the Compose file and read them via _FILE environment variable variants.

Run a dedicated backup container such as prodrigestivill/postgres-backup-local alongside the database with a cron schedule and retention policy for daily, weekly, and monthly backups. Mount a host backup directory and connect it to the backend network.

Set both limits and reservations under deploy.resources for CPU and memory on every service, sized to workload needs. Add ulimits for file descriptors and processes, and configure log rotation with max-size and max-file to prevent disk exhaustion.

Common causes are missing health checks, too-short start_period values, and services starting before dependencies are ready. Configure depends_on with service_healthy conditions and give slow-starting applications a generous start_period.