Maintaining Docker: updates, backups and security

Docker often runs for years without attention, until something goes wrong. With these habits your server stays clean, safe and recoverable.

Updates

Containers are not automatically updated. Do this per application, for example once a month:

cd ~/programma
docker compose pull
docker compose up -d
docker image prune -f

The last line cleans up old, unused images. For large applications, read the release notes first: sometimes a step is needed with a major version change. That’s also the reason to pin a version (like :2) instead of latest.

Backups of your data

A container is replaceable, your data is not. Therefore save:

the folder with your compose.yaml and .env;
the folders you mount to containers (bind mounts);
the named volumes.

You save a named volume like this to a file in the current folder. Replace mijn-volume:

docker run --rm -v mijn-volume:/data -v "$(pwd)":/backup alpine tar czf /backup/mijn-volume.tar.gz -C /data .

Stop a database first before you copy its files, or use an export like mysqldump. Save the backup in a different location than the server itself. How that works properly, you can read at Proxmox backups and in our guides about storage.

Keep space free

Old images and logs grow. First check what Docker uses:

docker system df

And clean up unused stuff. Warning: this removes stopped containers, unused networks and images without container. Data in volumes remains, unless you add --volumes (don’t do that).

docker system prune

Container logs can grow large. Limit them for all containers by creating or editing /etc/docker/daemon.json and then restarting Docker:

{
  "log-driver": "json-file",
  "log-opts": { "max-size": "10m", "max-file": "3" }
}

sudo systemctl restart docker

Security

Don’t open ports you don’t need. If you want to make a service accessible only on your own computer, write "127.0.0.1:8080:80" instead of "8080:80".
Docker often bypasses your firewall. A port you publish with ports: is accessible, even if ufw blocks it. The safest is to not publish the port or bind it to 127.0.0.1.
Rarely pass docker.sock. Who can access it, controls your entire server. Only needed for management applications like Portainer.
Run as regular user where the image allows it: user: "1000:1000" in your compose file.
Don’t use unknown images. Choose official or known sources and read what an image does.
Also update Docker itself with sudo apt update && sudo apt upgrade.

Good to know

With docker compose config you check your file and see what Compose makes of it.
Want to know how much memory and processing power containers use? docker stats shows it live.
Running Docker in an LXC container on Proxmox? At Options → Features turn on Nesting. Many people choose a VM, because that’s more stable.