Docker Compose production checklist

1. Pin deployable image versions

Avoid latest. A mutable tag makes rollback and incident analysis unreliable. Pin an immutable release tag or digest and record what was deployed.

services:
  api:
    image: ghcr.io/example/api:2.4.1

2. Add a real health check

A running process is not necessarily ready to serve traffic. Check a lightweight endpoint that verifies the dependencies required for requests.

healthcheck:
  test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
  interval: 30s
  timeout: 5s
  retries: 3
  start_period: 20s

3. Keep secrets out of Compose files

Do not commit passwords, tokens, or private keys. Inject them at deployment time through a protected environment file or a secrets manager. Restrict file permissions and rotate credentials after exposure.

4. Set restart behavior deliberately

restart: unless-stopped is a reasonable default for long-running services. Do not use restarts to hide a crash loop; alerts and bounded retry behavior still matter.

5. Define resource limits

One leaking container should not consume the entire host. Set memory and CPU constraints supported by your Compose deployment mode, then monitor actual usage before tightening them.

deploy:
  resources:
    limits:
      cpus: "1.00"
      memory: 512M

6. Persist only the data that must survive

Use named volumes for stateful data and test restoration from backup. Application containers should remain replaceable. Avoid bind-mounting source code in production.

7. Bound log growth

Unbounded local JSON logs can fill the server disk. Configure rotation or send logs to a centralized destination.

logging:
  driver: json-file
  options:
    max-size: "10m"
    max-file: "5"

8. Validate before deployment

docker compose config --quiet
docker compose pull
docker compose up -d
docker compose ps
docker compose logs --tail=100

Render the final configuration with docker compose config so environment substitutions and merged files can be reviewed before services change.