Secure external access
Publish selected applications through Cloudflare and Nginx Proxy Manager while protecting administrative services with authentication and MFA.
Container Platform Case Study
Docker EngineeringPlatform
A secure, observable and maintainable container platform supporting public applications, monitoring, identity and security, with file-backed secret delivery and validated encrypted recovery.
Executive Summary
The operational foundation of the portfolio.
The Docker Engineering Platform provides the foundation for the applications and services demonstrated throughout this portfolio.
Rather than running individual containers only to learn their basic commands, I developed a connected environment where applications can be securely published, authenticated, monitored, logged, protected and maintained over time.
The platform hosts the portfolio, monitoring services, security tooling, authentication, operational utilities and specialist workloads. This provides practical experience of the full service lifecycle—from initial planning and deployment through monitoring, troubleshooting, change and continual improvement.
The Challenge
Build more than a collection of containers.
Running isolated containers does not demonstrate how a platform will behave under real operational requirements.
The challenge was to create an environment incorporating secure external access, identity, networking, persistent data, monitoring, logging, alerting, security response, documentation and repeatable change.
Project Objectives
Designed around operational outcomes.
Central observability
Collect metrics and logs centrally so infrastructure, containers and applications can be monitored from one platform.
Repeatable deployment
Use Docker Compose, Git and documented configuration to make deployments understandable and reproducible.
Operational resilience
Design the platform so failures can be detected, investigated and resolved without relying on undocumented knowledge.
Security automation
Integrate behavioural threat detection and automated firewall enforcement into the public-service architecture.
Practical learning
Create a safe environment for developing modern infrastructure, cloud, container and automation skills.
Delivery Approach
Developed through structured, incremental change.
The platform evolved in controlled stages, with each phase adding a specific capability while preserving the existing operational environment.
Define the platform purpose
Established the environment as an operational engineering platform rather than a collection of unrelated containers.
Create the foundation
Implemented Docker Compose structures, shared networks, persistent storage and service-management conventions.
Publish services securely
Introduced Cloudflare, Nginx Proxy Manager, TLS certificates and controlled external access.
Add identity and protection
Integrated Authelia, MFA, CrowdSec and automated firewall enforcement.
Build observability
Added Prometheus, Grafana, Loki, exporters, dashboards and operational alerts.
Document and improve
Moved configuration into Git, documented architecture and continually refined platform operation.
Core Components
Services with clear operational responsibilities.
Container Platform
Docker and Docker Compose
Provides application packaging, service definitions, networking, persistent volumes and repeatable lifecycle management.Public Access
Cloudflare and Nginx Proxy Manager
Provide DNS, HTTPS, certificate management and reverse-proxy routing for externally published services.Identity
Authelia
Protects selected applications with central authentication, access policies and multi-factor authentication.Metrics
Prometheus and Exporters
Collect infrastructure, container, security and application metrics from across the platform.Visualisation
Grafana
Turns operational telemetry into dashboards, alerts and sanitised public evidence for the portfolio.Logging
Loki and Promtail
Centralise container, host and reverse-proxy logs for investigation and troubleshooting.Security
CrowdSec
Analyses proxy activity, creates security decisions and works with a firewall bouncer to block malicious traffic.Operations
Uptime Kuma, Dozzle and Portainer
Provide service-health monitoring, container-log access and operational container management.Platform Architecture
Layered access, applications, observability and security.
↓
↓
↓
Engineering Challenges
Problems resolved through investigation and design.
Container networking
Problem
Services spread across separate Compose stacks could not always resolve or communicate with one another.
Response
Introduced shared external Docker networks and verified communication from the consuming container.
Outcome
Nginx Proxy Manager, Grafana, Prometheus and application services can communicate without unnecessary host-port exposure.
Secure public publishing
Problem
Administrative applications required external access without exposing them directly or weakening authentication.
Response
Combined Cloudflare, Nginx Proxy Manager, Authelia and MFA with path-specific access policies.
Outcome
Protected services require authentication while selected public pages and dashboards remain accessible.
Security visibility
Problem
Firewall activity and CrowdSec decisions were difficult to explain using raw logs and command output.
Response
Built a custom firewall exporter, Prometheus metrics and Grafana security dashboards.
Outcome
Security activity is now measurable, alertable and understandable through live operational views.
Service consistency
Problem
Independent stacks can become difficult to maintain when naming, networks, labels and deployment methods differ.
Response
Standardised Compose conventions, directory structures, labels and deployment practices.
Outcome
The environment is easier to understand, troubleshoot and extend.
Operational Practices
Designed to remain supportable after deployment.
Monitoring
Prometheus and Grafana provide infrastructure, container, application and security visibility.
Alerting
Grafana alerts identify unavailable exporters, failed monitoring targets and unusual firewall activity.
Logging
Loki, Promtail and Dozzle support central investigation of application and reverse-proxy behaviour.
Security
Cloudflare, TLS, Authelia, MFA, CrowdSec and Linux firewall controls protect public services.
Change management
Configuration and encrypted recovery changes are version controlled, while protected live credentials use file-backed delivery and narrow runtime reconciliation.
Documentation
Architecture, implementation decisions and troubleshooting steps are documented alongside the platform.
Operational Outcomes
A functioning platform supporting real services.
Skills Demonstrated
Technical depth combined with operational thinking.
Lessons Learned
Operating the platform created the greatest value.
Monitoring and security are most effective when considered during platform design rather than added after deployment.
Shared conventions for networks, volumes, names and deployment processes greatly reduce troubleshooting time.
Documentation and version control make infrastructure changes safer, easier to review and less dependent on individual memory.
Most importantly, operating a platform over time exposes integration, support and maintenance challenges that cannot be learned from an isolated technical demonstration.
Live Evidence
Explore the operational platform.
A fixed Grafana dashboard snapshot and related case studies provide documented evidence of the platform in operation.