Learning path Beginner
Self-hosting with Docker: from zero to production
The guided path to build your own infrastructure with Docker: install the engine, master networking, volumes, secrets, healthchecks and resource limits, then add a dashboard, a reverse proxy, SSO and a security layer.
- 14 resources
- 5 views
- ~107 min
This learning path teaches you to build and run your own self-hosting infrastructure with Docker, from installing the engine to a production-ready stack with a reverse proxy, SSO and WAF protection. It’s built for anyone who wants to stop depending on third-party services and host their own applications on a server or VPS.
What you’ll be able to do
By the end you’ll know how to deploy and isolate services in containers, connect multiple containers through Docker networks, persist data with volumes, manage secrets without exposing them in code, and protect your stacks with healthchecks, resource limits and automatic updates. The level is beginner: no prior container experience is required, though basic Linux command-line skills help.
How the path builds
The route starts with installing Docker on Ubuntu 24.04 and the fundamentals of bridge and custom networks. From there it adds volumes and bind mounts so data survives container restarts, environment variables and secrets in Docker Compose, and healthchecks with restart policies for more reliable services. With that foundation in place you install Portainer to manage containers from a visual dashboard, set up a private image registry, and put Traefik in front of your services as a reverse proxy with automatic certificates. The final steps close the loop with Coolify as a deployment platform, Authentik for single sign-on and CrowdSec as a community firewall that blocks malicious IPs in real time.
It’s 14 steps that, followed in order, take you from a freshly installed server to an infrastructure with a dashboard, proxy, SSO and active security, the same stack thousands of homelabs and small production projects run on.
How to Install Docker on Ubuntu 24.04
Docker es la plataforma de contenedores más extendida. Esta guía explica cómo instalarlo en Ubuntu 24.04 LTS desde el repositorio oficial, con la clave GPG firmada en /etc/apt/keyrings y el plugin de Compose incluido.
Docker networking: bridge, host and custom networks
Docker ships six network drivers: bridge, host, none, overlay, macvlan and ipvlan. The default bridge network connects containers by IP but without name resolution. A user-defined bridge adds an internal DNS server so services find each other by name, and it is the recommended choice for almost any deployment.
Docker Volumes and Bind Mounts: Persisting Data
A container loses its data the moment you delete it, unless you store that data outside. Docker gives you two ways: named volumes, which it manages itself under /var/lib/docker/volumes, and bind mounts, which link a host folder. Here you will see when to use each, how to mount them in Compose and how to back them up.
Environment Variables and Secrets in Docker Compose
Docker Compose gives you three ways to pass configuration into a container: the environment key, the env_file attribute and the .env file for interpolation. For sensitive data, do not use environment variables; Docker Compose secrets are mounted as read-only files under /run/secrets/, away from logs and the process environment.
Healthchecks and Restart Policies in Docker Compose
A healthcheck is a command Docker runs periodically inside the container to decide whether the service is healthy; its state moves from starting to healthy or unhealthy. Combined with a restart policy (no, always, on-failure or unless-stopped) and with depends_on and the service_healthy condition, it stops an application from starting before its database.
Profiles in Docker Compose
Docker Compose profiles tag services so they only start when you enable their profile with --profile or COMPOSE_PROFILES. Services without a profile always run; tagged ones stay idle until you ask for them. That lets a single file hold the core stack, debugging tools and optional extras without duplicate compose files.
Resource Limits (CPU and RAM) and Logging in Docker
By default Docker limits neither the CPU nor the RAM of a container: a single one can exhaust the whole server. In Compose you bound them with deploy.resources.limits (cpus, memory) or the mem_limit and cpus shortcuts, and you control logs with the local driver, which rotates at 20 MB and 5 files by default.
How to install Portainer with Docker Compose v2
Portainer es la UI web de referencia para gestionar contenedores Docker, stacks de Compose y clusters Swarm/Kubernetes. Guía paso a paso con compose.yaml moderno, HTTPS en el puerto 9443, volumen nombrado y configuración opcional con Traefik.
How to Run a Private Docker Image Registry
A private Docker registry is your own image store: the official registry image listens on port 5000, keeps layers in a volume and, with htpasswd authentication in bcrypt format and HTTPS behind a reverse proxy, lets you push and pull images without depending on Docker Hub or its pull-rate limits.
How to Install Traefik with Docker Compose
Traefik is a reverse proxy that automatically discovers Docker containers through labels and renews TLS certificates via Let's Encrypt without manual work. To install it with Docker Compose, define its static configuration in traefik.yml, generate basic-auth credentials for the dashboard, and start the container connected to a dedicated Docker network.
Watchtower: Automatically Update Docker Containers
Watchtower is a container that watches your Docker registries, detects when a newer image is available, pulls it and recreates your container with the same options. You configure it with a small docker-compose.yml, it polls every 24 hours by default, and you can restrict it with labels or keep it in notify-only mode.
How to install Coolify on Docker (2026 step-by-step guide)
Coolify is a self-hosted deployment platform that runs on top of Docker: it manages Git applications, databases, and SSL certificates from its own web panel. It installs with an official script that brings up Docker and the Coolify containers in 2 to 5 minutes on Ubuntu 24.04 or Debian 13, with no additional manual steps.
How to Install Authentik for Self-Hosted SSO
Authentik es uno de los proyectos de identidad auto-alojada más sólidos del panorama open source. Guía práctica de instalación con Docker Compose, arquitectura sin Redis desde 2025.10 y los puntos de fricción reales en la primera instalación.
How to Install CrowdSec as a Community WAF
CrowdSec replaces fail2ban by separating detection (agent plus LAPI) from blocking (bouncers): install the agent with the official script on Debian or Ubuntu, enable the right collections, add a bouncer for Traefik or the firewall, and optionally captcha remediation via Cloudflare Turnstile plus the shared community blocklist.