Columbia Games / 28 September 2026
Production hardening: container ports and SSH protection must be explicit
We bound sensitive Docker services to localhost, strengthened server access controls and improved diagnostic logging in the Columbia Games infrastructure.
Situation
In a multi-container production stack, PostgreSQL, API services and development utilities may become security risks when Compose publishes ports on overly broad interfaces. Around the same time, latency alerts were appearing, but existing logs lacked sufficient timing detail for a reliable root-cause analysis.
Approach
We made Docker Compose bindings explicitly use the loopback interface for internal services and corrected PostgreSQL restart and health-check behavior. Nginx gained performance-oriented JSON logging, and we fixed webroot permissions affecting TLS certificate renewal. On a separate server, we validated and hardened the Fail2ban SSH jail with a real configuration test and post-restart verification.
Outcome
Sensitive services no longer rely on directly exposed public port bindings, and access and process restart behavior are easier to verify. We did not claim an unproven explanation for earlier latency spikes; instead, we added the measurements needed to analyze the next incident.