Skip to content

Docker Compose

Jump to bottom
AJprogramming123 edited this page Jun 21, 2025 · 1 revision

Docker & Cloudflare Tunnel Notes

Docker Compose: build + create + start = up

docker-compose up is a shortcut for running:

docker-compose build && docker-compose create && docker-compose run

Environment Variables

Use Cases:

Logger.log("logging from environment:{runtime_env}")

if(runtime_env == "test"):
    disable_payments()

Example in docker-compose.yml:

environment:
  - runtime_env=dev

What are environment variables? Environment variables are key-value pairs stored in the environment where a program runs. They configure applications without hardcoding values into your code.

  • Useful to avoid hardcoding sensitive information.
  • Typically stored in a .env file.

Example passing secret key:

environment:
  - RAPIDAPI_KEY=${RAPIDAPI_KEY}

Volumes

What are volumes? Volumes are persistent container storage — special folders on your host computer that Docker uses to store data outside the container.

Why use volumes? So your data doesn’t get deleted every time you stop or rebuild a container.

Important:

  • Docker image = code, binaries, and layers that make your app.
  • Volumes = stored outside the image and container, persistent data storage.
  • Volumes are not part of the network and are not used for communication.

Example volume syntax:

-v pgdata:/var/lib/postgresql/data
  • pgdata → a Docker volume stored on your local system (managed by Docker).
  • /var/lib/postgresql/data → folder inside the container where PostgreSQL saves its data.

This means: Take a folder on the local system (managed by Docker) and connect it to the internal folder Postgres uses to store its data.

Create and run example:

docker volume create pgdata

docker run -d \
  --name new-demo-postgres \
  -e POSTGRES_PASSWORD=12345 \
  -v pgdata:/var/lib/postgresql/data \
  postgres

Checking Open Ports Inside Container

Check if port 5000 is listening inside your container (or host):

sudo ss -tulnp | grep 5000

Docker Run without Publishing Ports

If you don’t publish ports explicitly, they remain internal only and not accessible externally:

docker run -d \
  --name backend-container \
  --network mynetwork \
  -e RAPIDAPI_KEY=your_key_here \
  your-backend-image

No -p flag means the port inside container is NOT exposed to the host/network externally.

Cloudflare Tunnel & Firewall Explanation

Because your Raspberry Pi initiates the connection outbound to Cloudflare’s servers, the firewall treats this as an allowed outgoing connection. This is a classic client-server handshake:

  • Your Pi (client) opens the connection outbound.
  • Cloudflare (server) accepts and maintains it.
  • External users send requests through Cloudflare, which routes them back over this established tunnel.

This approach means you do not need to open inbound ports on your firewall, making your setup more secure yet externally accessible.

This is the same principle behind VPNs, SSH tunnels, and many other secure network connections.

Cloudflare Tunnel Network Ports

Cloudflare Tunnel typically uses outbound HTTPS (port 443) for communication:

  • Tunnel client on your Pi makes an outbound TLS (HTTPS) connection to Cloudflare edge servers on port 443.
  • HTTPS (port 443) is almost always allowed outbound on networks/firewalls, so the tunnel is reliable.
  • If HTTPS is blocked, it can fallback to port 80 (HTTP), but 443 is standard.

Bottom line: Your firewall must allow outbound connections on port 443 for the tunnel to work. Inbound ports do not need to be opened.

Clone this wiki locally