A Docker footgun led to a vandal deleting NewsBlur's MongoDB database(blog.newsblur.com)

  version: '3.4'
  services:
    # you would probably want to run MongoDB not exposed to the outside world at all
    # notice that there are no ports exposed here, given that we're using Docker networking
    mongodb_container:
      image: mongo:bionic
      restart: "unless-stopped"
      environment:               
        - MONGO_INITDB_ROOT_USERNAME=lazy_example_of_a_single_file_config
        - MONGO_INITDB_ROOT_PASSWORD=but_you_should_be_able_to_store_this_in_secrets
        # see docs for MONGO_INITDB_ROOT_PASSWORD_FILE at https://hub.docker.com/_/mongo
      deploy:
        replicas: 1
        placement:
          constraints:
            - node.hostname == your-mongo-server.com # just an example, probably use labels instead
        resources:
          limits:
            cpus: "4"
            memory: "8G"
    # your web application wouldn't need to be exposed to the outside world either
    # it could just receive the requests from a web server that ensures SSL/TLS
    web_application:
      image: hello-world # which you would replace with your actual app
      restart: "unless-stopped"
      environment:               
        - APP_CONFIG=variables_go_here_or_in_a_config_map
        - MONGO_HOST=mongodb_container
        - MONGO_PORT=27017
        - MONGO_USERNAME=either_the_username_above_or_a_non_root_one
        - MONGO_PASSWORD=though_the_non_root_needs_separate_creation
        # maybe with a helper container, like some people use dbmate for RDBMS
      deploy:
        replicas: 4
        placement:
          constraints:
            - node.hostname == your-application-server.com # just an example, probably use labels instead
        resources:
          limits:
            cpus: "2"
            memory: "2G"
    # finally, the actual web server is the ingress point, which you can self host
    # in the case of Kubernetes and other fancy tech you'd be able to use external solutions, probably
    web_server:
      image: caddy:alpine # or another web server, that would actually be exposed
      restart: "unless-stopped"
      ports:
        - 80:80
        - 443:443
        # though sometimes you need the long format for the above so client IPs resolve correctly
      volumes:
        - some_config_directory:/etc/caddy/Caddyfile
        - some_other_config_directory:/data
        - yet_another_config_directory:/config
      deploy:
        replicas: 4
        placement:
            constraints:
            - node.hostname == your-ingress-server.com # just an example, probably use labels instead
        resources:
          limits:
            cpus: "2"
            memory: "2G"