Docker Compose Production Deployment on a Linux VPS: Hardening, SSL & High Availability

Deploying multi-node Kubernetes clusters introduces heavy resource overhead for small-to-medium digital platforms. Modern Docker Compose delivers declarative microservice orchestration with minimal CPU/RAM footprint. This production runbook covers automated Traefik Let’s Encrypt TLS termination, daemon security tuning, secrets management, non-root execution, and zero-downtime rolling container deploys on cloud UK VPS hosting.

While Kubernetes dominates hyper-scale multi-datacenter container orchestration, deploying a multi-node Kubernetes cluster for small-to-medium production workloads introduces overwhelming operational complexity and resource overhead. For vast numbers of production services, modern Docker Compose represents the optimal balance of declarative infrastructure, resource isolation, and operational simplicity. This technical deployment guide explains how to engineer a production-ready Docker Compose production deployment on a Linux VPS, incorporating Traefik reverse proxying with automated Let’s Encrypt SSL, internal bridge networking, systemd service integration, log rotation, secret management, container health checks, and zero-downtime rolling container updates.

1. The Kubernetes Fallacy: Sizing Orchestration to Workload Realities
2. Production-Grade Docker Daemon Configuration
3. Automated Ingress Routing & SSL Termination with Traefik
4. Managing Production Secrets & Environment Variables Securely
5. Automated Container Healthchecks & Graceful Shutdowns
6. Multi-Container Volumes & Atomic Backups
7. Resource Quotas: CPU, Memory, and OOM-Killer Tuning
8. Hardening Container Security: Rootless Execution & Seccomp
9. Zero-Downtime Rolling Container Deployment Script
10. Integrating Docker Compose with Linux Systemd
11. Frequently Asked Questions (FAQ)

{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "50m",
    "max-file": "3"
  },
  "live-restore": true,
  "userland-proxy": false,
  "no-new-privileges": true,
  "default-ulimits": {
    "nofile": {
      "Name": "nofile",
      "Hard": 65536,
      "Soft": 65536
    }
  }
}

version: '3.8'

networks:
  traefik_public:
    external: true
  internal_backend:
    internal: true

services:
  traefik:
    image: traefik:v3.0
    container_name: traefik_edge
    restart: always
    security_opt:
      - no-new-privileges:true
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik.yml:/etc/traefik/traefik.yml:ro
      - ./acme.json:/acme.json
    networks:
      - traefik_public

  web_app:
    image: myregistry.co.uk/app:v1.4.2
    container_name: web_application
    restart: unless-stopped
    networks:
      - traefik_public
      - internal_backend
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.app.rule=Host(`app.example.co.uk`)"
      - "traefik.http.routers.app.entrypoints=websecure"
      - "traefik.http.routers.app.tls.certresolver=letsencrypt"
      - "traefik.http.services.app.loadbalancer.server.port=3000"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 20s

# Restrict .env read permissions exclusively to root
chmod 600 /opt/stacks/production/.env
chown root:root /opt/stacks/production/.env

# Build image with ephemeral mount secrets (never leaves trace in layers)
docker build --secret id=npmrc,src=/root/.npmrc -t myregistry.co.uk/app:v1.4.2 .

process.on('SIGTERM', () => {
  console.log('SIGTERM signal received: closing HTTP server');
  server.close(() => {
    console.log('HTTP server closed. Terminating database pools.');
    db.pool.end(() => {
      process.exit(0);
    });
  });
});

# Non-blocking named volume backup using ephemeral Alpine container
docker run --rm \
  --volumes-from db_service:ro \
  -v /mnt/backups:/backup \
  alpine tar czf /backup/db_volume_$(date +%Y%m%d_%H%M%S).tar.gz -C /var/lib/mysql .

services:
  web_app:
    image: myregistry.co.uk/app:v1.4.2
    deploy:
      resources:
        limits:
          cpus: '2.00'
          memory: 2048M
        reservations:
          cpus: '0.50'
          memory: 512M
    mem_swappiness: 0

services:
  web_app:
    image: myregistry.co.uk/app:v1.4.2
    user: "1001:1001"
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=64m
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    security_opt:
      - no-new-privileges:true
      - seccomp:/etc/docker/seccomp/strict.json

#!/usr/bin/env bash
set -e

echo "[+] Pulling latest container image..."
docker compose pull web_app

echo "[+] Scaling up new container instance..."
docker compose up -d --no-deps --scale web_app=2 --no-recreate web_app

echo "[+] Waiting for new container to pass health checks..."
sleep 15

echo "[+] Terminating stale container instance..."
OLD_CONTAINER=$(docker ps -q -f name=web_application | head -n 1)
docker stop "$OLD_CONTAINER"
docker rm "$OLD_CONTAINER"

echo "[+] Scaling back to single replica..."
docker compose up -d --no-deps --scale web_app=1 --no-recreate web_app

echo "[+] Zero-downtime deployment complete!"

[Unit]
Description=Docker Compose Application Stack
Requires=docker.service
After=docker.service network-online.target

[Service]
Type=oneshot
RemainAfterExit=yes
WorkingDirectory=/opt/stacks/production
ExecStart=/usr/bin/docker compose up -d --remove-orphans
ExecStop=/usr/bin/docker compose down
ExecReload=/usr/bin/docker compose pull && /usr/bin/docker compose up -d

[Install]
WantedBy=multi-user.target