Compose map
Paste a docker-compose file to see your services as a map, and what’s exposed, in plain words.
Example: a homelab
One service can take over the whole host, and five more things are worth a look.
The frontend network
- jellyfin, jellyfin/jellyfin, open to your network on port 8096
- Host ./jellyfin at /config
- Host /srv/media at /media, read-only
- nextcloud, nextcloud:29, open to the server only on port 8080
- Volume nextcloud at /var/www/html
- Starts after db is healthy.
- Also on backend network.
- caddy, caddy:2.8, open to your network on port 80, open to your network on port 443, open to your network on port 443/udp
- Host ./Caddyfile at /etc/caddy/Caddyfile, read-only
- Volume caddy-data at /data
- Starts after jellyfin and nextcloud.
The backend network
- db, postgres:16
- Volume db at /var/lib/postgresql/data
The default network
- watchtower, containrrr/watchtower, controls Docker
- Host /var/run/docker.sock at /var/run/docker.sock
What’s worth a look
- watchtower can control Docker itself through /var/run/docker.sock, which means the whole host.
- db has POSTGRES_PASSWORD=•••• written in the file, so anyone who can read the file can read it. An env_file or a Docker secret keeps it out.
- caddy is open to every device on your network on ports 80, 443 and 443/udp, and to the internet if your router forwards them. If only the server itself needs them (another container, or a reverse proxy on the same host), write 127.0.0.1:80:80, and the same for each.
- jellyfin is open to every device on your network on port 8096, and to the internet if your router forwards it. If only the server itself needs it (another container, or a reverse proxy on the same host), write 127.0.0.1:8096:8096.
- jellyfin and watchtower use the latest image, so an update can change them without warning. Add a version to each image name to choose when they change.
- watchtower has no restart policy, so it won’t come back after a reboot.