VPS, Docker and infrastructure security audit
Independent assessment · documented findings · agreed scope
An exposed port, privileged container or secret in a build context can undermine application controls. My review treats runtime, networking, access and delivery as connected parts of the system.
Request an audit →Telegram @ifwcom
What I review
- Inventory of containers, runtimes, images, tags and dependencies.
- Published ports, Docker forwarding, IPv4/IPv6 and observable firewall rules.
- SSH, administrative access, file permissions and secret storage.
- Compose, volumes, capabilities, runtime user and resource limits.
- Backup/rollback readiness, background services and controlled upgrades.
The baseline and service count are agreed before access. Multiple servers, Kubernetes, OS/database migration and infrastructure rollout need a separate quote.
My assessment and remediation process
Inventory
I agree the scope, access and service list, then record versions, dependencies and critical workflows.
Read-only assessment
Within the agreed access, I inspect code, configuration and applicable advisories without modifying the live system.
Evidence and priorities
Confirmed findings receive sanitized evidence, an impact assessment, priority and remediation estimate.
Agree the changes
Specific changes, backups, staging and rollback criteria are agreed separately.
Patch and test
Once authorized, I prepare fixes and check affected behavior in an isolated environment.
Production is a separate decision
Deployment requires separate approval, a rollback plan and an agreed maintenance window.
What you receive
- A report with confirmed findings and explicit assessment boundaries.
- Remediation priorities and impact on data or service behavior.
- Recommendations and an estimate for the next stage, without automatic deployment.
My conclusions apply to the reviewed scope and the system state at the assessment date. No review can guarantee the absence of all vulnerabilities.
Exclusions and separately priced work
A full penetration test, fixing every defect, OS/database migration, production deployment and paid external services are excluded unless separately agreed. Implementation and additional review cycles are estimated by scope.
Frequently asked questions
Does Docker automatically keep a database private?
No. Actual port publication, network paths and IPv4/IPv6 rules must be inspected. A host firewall alone does not prove protection of a published port.
Does €100 include server migration?
No. The baseline is an assessment of the agreed VPS and services. Migration and production rollout are quoted separately.
What should I send for an estimate?
Your stack, project/service count, review goal and known symptoms. Do not send passwords, tokens or personal data through the form.
Will the audit change production?
The read-only stage does not modify production. Fixes and deployment require separate agreement and approval.
Services, article and documented case studies
Start with a clear scope
Describe the current system and your concern. I will agree the assessment type and price boundaries before work begins.
Related case studies and reading
Website and server migrationPlanning migration, backups, verification and rollback.
MiniSMTP: SMTP relay with an HTTP API in DockerExplore the project problem, solution and limitations.
Discuss your project
If you have a project involving Python, Laravel, Node.js, CRM, Telegram, AI/RAG, API integrations, automation or TON/GRAM logic, send me a short description of what you need.
You can simply explain what exists now, what is not working, what outcome you expect and which services are already involved.