Your AI-built app is ready. What about the server?

Your app works locally. You can create an account, click through it and show a demo. Production work begins when the right people need access to the right data, even when a request fails.

Whether the code came from Codex, Grok or you does not change the questions to ask about the server. Who can administer it? Where are the secrets? How do you return to the previous version? Here is a starting point for a VPS deployment, not a security certification.

Expose the site, not the whole machine

In this example, Caddy runs on the host and receives web traffic. The Docker app is published only on the server’s loopback address. It listens on 0.0.0.0:3000 inside the container. The image must already support running without privileges and without writing outside designated locations.

APP_IMAGE must contain a verified image reference, ideally pinned by digest. User 10001 must match your image’s user. Adjust memory limits after measuring usage. Do not put secrets in this file or bake them into the image.

1services:
2  app:
3    image: ${APP_IMAGE:?Set a verified image reference}
4    user: "10001:10001"
5    restart: unless-stopped
6    ports:
7      - "127.0.0.1:3000:3000"
8    read_only: true
9    tmpfs:
10      - /tmp:size=64m,mode=1777
11    cap_drop:
12      - ALL
13    security_opt:
14      - no-new-privileges:true
15    pids_limit: 100
16    mem_limit: 512m
17    cpus: 1.0

Connect the domain and check from outside

Replace app.example.com with your domain and point its DNS to the VPS. For Caddy’s standard HTTPS setup, ports 80 and 443 need to be reachable and its data directory must remain persistent. SSH administration stays restricted to the intended access paths.

1app.example.com {
2  reverse_proxy 127.0.0.1:3000
3}

Prepare for failure before launch

Use a patched Docker version and test ports from another machine. Its documentation notes a loopback port isolation limitation before version 28.0.0. Published ports can also bypass UFW rules. An “active firewall” status is not enough.

Before opening registration, check authorization with two separate accounts, limits on public endpoints and restoration from an off-server backup. Keep the previous image and plan for migration rollback. Docker and HTTPS do not fix an endpoint that lets someone read another account’s data.