dokploy-security-hardening

Dokploy Security Hardening

When to Use This Skill

• When reviewing templates for security issues
• When adding security configurations to templates
• When user asks about "security" or "hardening"
• As final review step before template completion

When NOT to Use This Skill

• For application-level security (auth, input validation)
• For host-level security (not managed by Dokploy)

Prerequisites

• Completed docker-compose.yml
• Understanding of application security requirements

---

Security Principles

1. Least Privilege: Services only have access they need
2. Defense in Depth: Multiple security layers
3. Secrets Protection: No hardcoded secrets
4. Network Isolation: Internal services not exposed
5. Image Security: Pinned versions, trusted sources

---

Core Patterns

Pattern 1: Secrets Management

Never Hardcode Secrets:

# WRONG - Secret in compose file
environment:
  DATABASE_PASSWORD: supersecretpassword123

# CORRECT - Use variable with required syntax
environment:
  DATABASE_PASSWORD: ${DATABASE_PASSWORD:?Set database password}

Use Proper Variable Generation in template.toml:

[variables]
# Passwords - random alphanumeric
db_password = "${password:32}"

# Secrets - base64 encoded
secret_key = "${base64:64}"
jwt_secret = "${base64:48}"

# Internal tokens - high entropy
internal_token = "${password:48}"

Mask Sensitive Output:

# In docker-compose, sensitive vars are hidden in Dokploy UI
environment:
  API_KEY: ${API_KEY:?Set API key}  # Treated as sensitive

Pattern 2: Network Isolation

Database/Cache Services (Internal Only):

services:
  postgres:
    image: postgres:16-alpine
    networks:
      - app-net  # Internal ONLY - no dokploy-network
    # NO labels - not exposed via Traefik

  redis:
    image: redis:7-alpine
    networks:
      - app-net  # Internal ONLY

Web Services (External + Internal):

services:
  app:
    image: myapp:1.0.0
    networks:
      - app-net        # Internal (to reach database)
      - dokploy-network # External (for Traefik)
    labels:
      - "traefik.enable=true"
      # ... routing labels