Docker Port Publishing: A Security Wake-Up Call 🚨

Did you know that ports: "5432:5432" in your docker-compose.yml is exposing your database to the entire internet?

I see this mistake constantly in production environments. Here's what's actually happening:

❌ What you think you're doing:

services: postgres: image: postgres:15 ports: - "5432:5432" # "Just making it accessible to my app" 

🌍 What you're actually doing:

Binding port 5432 to 0.0.0.0:5432 - making your database accessible from ANY IP address that can reach your server.

✅ Here's how to fix it:

Option 1: Bind to localhost only

ports: - "127.0.0.1:5432:5432" # Only accessible from the host machine 

Option 2: Use Docker networks (recommended)

# No ports section needed! services: postgres: image: postgres:15 networks: - app-network web: image: my-app networks: - app-network ports: - "80:3000" # Only expose what users need networks: app-network: 

🔐 Pro tip: Your application containers can communicate with each other using service names as hostnames within the same network. No port publishing required!

The golden rule: Only publish ports that external clients need to access directly.

Have you caught this security issue in your own Docker setups? Share your Docker security tips in the comments! 👇