Coolify Operation Security Guide: Ports and Settings to Secure After Initial Installation
Installing the self-hosted platform Coolify on a VPS allows you to build a deployment environment like Vercel without complex Kubernetes or cloud console overhead. While it installs easily with a single script, the instance remains vulnerable to external scanners immediately after the default setup.
I have summarized the essential security hardening steps and precautions you must take before putting Coolify v4 into production.
Blocking External Access to Ports 8000, 6001, and 6002 After Domain Connection
Once installation is complete, several ports are opened directly to the host IP to allow dashboard access.
Port 8000 is used for initial web dashboard access, port 6001 for real-time event communication, and port 6002 for the browser-based web terminal proxy. Ports 80 and 443 are reserved for Traefik, Coolify's internal reverse proxy, which manages external web traffic and SSL certificate issuance.
Once you have connected a custom domain and accessed the dashboard via HTTPS through Traefik, there is no reason to leave ports 8000, 6001, and 6002 open. After linking a domain, both dashboard and WebSocket traffic are routed through port 443.
You must immediately block inbound access to these three ports via your cloud security groups or firewall. However, ensure you do not alter the rules for SSH, 80, or 443 to avoid locking yourself out of the server.
Binding to Localhost to Prevent Docker Network Bypass
It is common for users to encounter trouble when relying solely on the UFW firewall on a Linux host. This happens because the Docker daemon modifies iptables chains directly, effectively bypassing UFW rules and reopening container ports to the outside.
The most reliable solution is to configure cloud virtual network-level security groups or limit the Coolify container port bindings to the local loopback address.
By adding an override configuration file to your Coolify v4 source directory, your settings will persist and won't be overwritten when running upgrade scripts.
/data/coolify/source/docker-compose.override.yml Open this file and restrict the port mapping to localhost.
After saving the file and re-running the upgrade script, the Docker daemon will bind the container ports only to localhost rather than the external public IP, effectively blocking unauthorized scans at the source.
Backing Up Core Environment Variables and Controlling Permissions
Key information for the Coolify control plane is stored in the /data/coolify/source/.env file. Since this single file contains your database encryption keys and master settings, you must strictly limit file permissions.
It is safer to ensure that only the root user can access the file and to maintain separate offline backups to prevent the original file from being accidentally committed to configuration management tools.
Within the dashboard settings, you should enable two-factor authentication for the admin account and disable unnecessary public registration options. Because Coolify administrative privileges have the same impact as root access on the host, it is recommended to assign read-only roles to casual team members who do not require deployment permissions.