Not expose the server IP is one practice (obfuscation) in a list of several options.

But that alone would not solve the problem being a RCE from HTTP, that is why edge proxy provider like Cloudflare[0] and Fastfy[1] proactivily added protections in his WAF products.

Even cloudflare had an outage trying to protect his customers[3].

- [0] https://blog.cloudflare.com/waf-rules-react-vulnerability/ - [1] https://www.fastly.com/blog/fastlys-proactive-protection-cri... - [2] https://blog.cloudflare.com/5-december-2025-outage/

No provider is perfect - It's totally possible to run your own FW behind it, or run CF Tunnel on a separate container that routes traffic to individual application containers using something like traefik, nginx proxy manager, etc.

Same doubt here, a disaster even bigger (Maybe in Mac ?)

That is why I prefer OTP all the time, easier to backup and restore.

Some Cloud functions like lambda support OCI container as a runtime target for example.

I understand that feeling but can be hard a provider that fill all that requirements without a expensive cost.

Integrate with the edge computing is part of the price you pay for all the conveniences like automatic builds, Cron and public reachable endpoints (and some of them almost free).

A minimal VPS with linux is always an alternative.

Really great post with that interactive examples and the example of mysql x postgrel too.

I would like read more about that topics with that level of detail.

Using podman for years for local containers development and the last months for hosting my personal services is good to see that.

Congrats to podman team.

For me replicate an old P3 1000mhz that I study and played a lot of games.

The attention and care to the details of that post are incredible.

Easy and useful, usually the basic is better.

I ever plan do it with sqlite, loading it at memory during app start and flush data to s3 during runtime but it create more corner cases and logic to handle.

I understand that disks snapshots with ZFS for example can cover most part of the needed on recovery scenarios.

But immutable OS are helping in progress some sandbox tools and allowing new workflows to manage the OS (virtualized or not).

You can use a localhost Cockpit with SSH Port Forwarding.

> Configure Cockpit to listen only loopback/127.0.0.1[1]:

[Socket]

ListenStream= #This remove 0.0.0.0:9090 bind based on the docs

ListenStream=127.0.0.1:9090

> Execute in your machine a port forward with SSH[2]:

ssh -N -L 9090:127.0.0.1:9090 host@ip

> Then you can open localhost:9090 in your browser securely only using SSH (that is already part of your actual workflow).

[1]: https://cockpit-project.org/guide/latest/listen

[2]: https://coder.com/docs/code-server/guide#port-forwarding-via...

Yes but if there's going to be something lightweight and correct-by-default I'd prefer that, mostly because I have many machines to manage and a team of people to educate. I'd like default to be good instead of wasting time and risking.