Do I need to open ports for inter-container communication?

No. Containers on the same Docker network can communicate without port mappings. If you're using Coolify managed network, simply remove the ports: section from your compose file and use expose: instead.

Does Hetzner Cloud Firewall block Docker ports?

No. Docker port publishing uses both DNAT and docker-proxy to bypass all host-level firewalls. Use Hetzner Cloud Firewall as defense-in-depth, but don't rely on it as primary protection.

How to keep databases secure on Coolify?

The safest approach is using a managed service (Neon, Supabase). If you must self-host: remove port mappings, use Docker internal network, disable 'Make it publicly available' toggle, and take regular disk snapshots.

Why does the build cache reset on every deployment?

Before Coolify v4.0.0-beta.450, automatically injected build arguments (SOURCE_COMMIT, COOLIFY_CONTAINER_NAME) changed on every build, invalidating the entire Docker layer cache. Update Coolify to fix this.

Hetzner + Coolify Hardening Checklist: A Battle-Tested Guide

TL;DR

A best practice checklist compiled from real incidents while deploying 4 projects on Hetzner VPS with Coolify. Covers Docker port binding rules, Coolify toggle risks, database security, container UID matching, build cache protection, and hybrid infrastructure strategy. Every item comes from a real incident.

View Subscription Sign In