Secure Docker Compose Homelab Stack with Caddy Reverse Proxy Last updated: August 2026 Tested on: Ubuntu 24.04 LTS, Docker Engine [add your tested version] , Docker Compose v2 [add your tested version] , Caddy 2, Uptime Kuma 2, LAN-only server at 192.168.1.20 . Replace this line with your real test environment before publishing. Most Docker Compose examples are written to get the service running quickly. That is fine when you are testing something on a spare evening. It is less fine six months later, when the home server has ten containers, five open ports, two forgotten dashboards, one mystery database volume and no clear restore process. This guide shows how I would build a secure Docker Compose homelab stack before adding Jellyfin, Paperless, Gitea, Home Assistant, dashboards, media tools, databases or anything else that slowly turns a Linux box into “production” at home. This is not enterprise Kubernetes. It is not a polished corporate platform. It is a practical D...
There is a small Docker habit that causes a surprisingly large security problem on home servers: ports: - "8080:80" It looks harmless. It looks like a normal Docker Compose example. It is in half the tutorials on the internet. Then you check UFW and it says the firewall is active. Default incoming traffic is denied. Port 8080 is not allowed. Everything looks fine. Except the container may still be reachable. This is one of those Linux home server problems that feels like a bug the first time you see it. It is not really a bug. It is Docker doing exactly what Docker is designed to do: create its own firewall and NAT rules so published container ports work. That is the part many people miss. Last updated: June 2026 This guide is for the usual homelab setup: Ubuntu, Debian or a similar Linux server, rootful Docker Engine, Docker Compose, UFW enabled, and a few self-hosted services running on an old workstation, mini PC, laptop server or small VPS. If you are ...