Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers VPS plans with one-click Docker, NVMe storage and a 14-day free trial.
Use Nginx as the only published web gateway, attach it and each application container to the same Docker network, and point each server block at the application’s Compose service name and internal port. For example, proxy_pass http://web:8080; lets Nginx reach a service named web without exposing port 8080 on the host. A separate server block can then route each hostname to the correct container.
The reliable workflow is: create or reuse a shared network, define the services, mount one configuration file per hostname, forward the original request headers, validate Nginx inside its container, and test name resolution and HTTP connectivity from that same container. The procedure below covers a single Compose project, multiple projects, TLS termination, private backend networks, WebSockets, and the common errors that produce 502 responses.
What an Nginx server block does in a Docker deployment
A server block is Nginx’s virtual-host configuration. It selects requests by listening address and port, then by the request’s Host header through server_name. Its location rules decide whether Nginx serves files, redirects the request, or proxies it to an upstream application.
When Nginx proxies a request, it sends a new request to the configured upstream, receives the response, and returns that response to the client. In Docker, the upstream address should normally be the Compose service name, not a container IP. Docker’s internal DNS resolves that name for containers attached to the same user-defined network.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
Publishing only Nginx’s ports keeps application ports off the host and prevents clients from bypassing routing, TLS, authentication, and logging rules. The application still listens on its container port; Nginx reaches it over the private Docker network.
Choose the network layout first
One Compose project
Compose creates a project network automatically. Services declared in the same file join that network unless you override their network settings, and each service is discoverable by its service name. A service named web is therefore reachable at web from Nginx, while a service named api is reachable at api.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Separate Compose projects
If Nginx and an application are managed by different Compose files, create one external network once and attach both projects to it:
docker network create edgeDeclare that existing network in each Compose file:
networks:
edge:
external: true
name: edgeBoth the proxy service and the backend service must list edge under their networks. The DNS name available to Nginx is the backend’s service name (or an explicitly configured network alias), not necessarily the container name shown by docker ps.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Use separate private networks when needed
A proxy can join an edge network and one or more application networks. This lets unrelated backends remain isolated from one another while still allowing Nginx to reach the services that need public ingress. Do not attach every container to one broad network merely for convenience; each additional attachment expands the set of containers that can connect directly.
Define Nginx and the backend in Compose
This minimal file publishes ports 80 and 443 on Nginx, mounts read-only configuration, and keeps the application’s port internal:
services:
nginx:
image: nginx:stable
ports:
- "80:80"
- "443:443"
volumes:
- ./nginx/conf.d:/etc/nginx/conf.d:ro
# Mount certificates here when Nginx terminates TLS
# - ./nginx/certs:/etc/nginx/certs:ro
depends_on:
- web
networks:
- edge
web:
image: your-app-image
expose:
- "8080"
networks:
- edge
networks:
edge:
driver: bridgeexpose documents and makes the internal port available to connected services; it does not publish that port on the host. You can omit it if the application listens on 8080, but keeping it makes the intended contract visible. Do not add ports: - "8080:8080" unless a host-level client genuinely needs direct access.
depends_on controls startup order, not application readiness. Nginx may start while the application is still initializing. Add a backend health check and gate application traffic at the orchestration layer when startup timing matters; always expect Nginx to return an upstream error until the application is ready.
Create one server block for each hostname
Create a file such as ./nginx/conf.d/example.conf, which is mounted into /etc/nginx/conf.d:
Recommended Free Tools
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
server {
listen 80;
server_name example.com www.example.com;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://web:8080;
}
}The hostname in proxy_pass is the Compose service name, and 8080 is the application’s internal listening port. Nginx resolves that name through Docker’s embedded DNS because both containers are on edge.
Why each proxy header matters
Hostpreserves the hostname the client requested. Frameworks use it for virtual hosting, URL generation, and tenant selection.X-Real-IPcarries the immediate client address.X-Forwarded-Forappends the client address to any existing proxy chain, allowing the application to reconstruct the route.X-Forwarded-Prototells the application whether the client used HTTP or HTTPS, which prevents incorrect redirects and mixed-content URLs when TLS ends at Nginx.
Only trust forwarded headers from your own proxy. If the application is also reachable directly from an untrusted network, a client could forge those headers.
Route several hostnames and services
Use separate server blocks when hostnames should reach different services:
server {
listen 80;
server_name app.example.com;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://web:8080;
}
}
server {
listen 80;
server_name api.example.com;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://api:9000;
}
}Keep the location path and upstream path semantics in mind. With proxy_pass http://web:8080;, Nginx passes the request URI through. Changing the directive to include a path, such as proxy_pass http://web:8080/;, changes how the matching location prefix is replaced. Test any path rewrite with a request that exercises both the root and a nested URL.
Start, validate, and reload safely
- From the directory containing the Compose file, start the stack with
docker compose up -d. - Check that the services are running and that only the intended ports are published:
docker compose ps. - Validate the complete Nginx configuration inside the running proxy container:
docker compose exec nginx nginx -t. Do not reload after a failed test. - Apply a valid change without stopping the container:
docker compose exec nginx nginx -s reload. A full restart,docker compose restart nginx, is an alternative when you have changed mounted files or environment-dependent startup settings. - Watch the proxy log while making a request:
docker compose logs -f nginx. Keep the application log open as well so you can distinguish a proxy failure from an application failure.
If the Nginx container has not started, run the syntax test against a temporary container using the same mounted configuration, or inspect the container’s startup output. A malformed file in conf.d prevents Nginx from loading all server blocks.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Test from inside the proxy container
A request that works from the host does not prove that Docker DNS and the internal route work. Test from Nginx’s network namespace:
- Open a shell:
docker compose exec nginx sh. - Check name resolution. Minimal images may not include diagnostic tools; if
getent hosts webis available, run it. Otherwise use a temporary troubleshooting container attached to the same network. - Request the backend’s internal port, for example
wget -S -O - http://web:8080/orcurl -v http://web:8080/when those utilities are installed. - Exit the shell and compare the result with a request through the public listener, such as
curl -H 'Host: example.com' http://127.0.0.1/on the Docker host.
Inspect network membership when a name cannot be resolved:
docker network inspect edgeBoth the Nginx container and the backend container must appear in the network’s container list. If they do not, correct the Compose networks sections and recreate the services with docker compose up -d.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteAdd TLS without exposing the backends
A common arrangement terminates TLS at Nginx. The proxy listens on 443, presents the certificate, and forwards an HTTP request over the private Docker network. The backend does not need a public certificate or a published port.
Use a second server block for HTTPS and a small HTTP block that redirects to it:
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
server {
listen 80;
server_name example.com www.example.com;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl;
server_name example.com www.example.com;
ssl_certificate /etc/nginx/certs/example.com/fullchain.pem;
ssl_certificate_key /etc/nginx/certs/example.com/privkey.pem;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://web:8080;
}
}Mount certificate files read-only, renew them using your chosen certificate process, then run nginx -t and reload Nginx after renewal. If TLS terminates at another load balancer instead, keep the forwarded-protocol convention consistent and configure Nginx to trust headers only from that known proxy.
Support WebSockets, streaming, and long requests
Regular HTTP proxying is enough for ordinary request-response traffic. WebSockets require the HTTP upgrade handshake to pass through:
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
server {
listen 80;
server_name realtime.example.com;
location / {
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 300s;
proxy_pass http://websocket:8080;
}
}Long polling, server-sent events, downloads, and streaming endpoints may also need a longer proxy_read_timeout and buffering adjustments appropriate to the application. Change these settings only for the locations that need them; disabling buffering globally can increase memory and connection pressure.
Diagnose the errors you actually see
| Symptom | Likely cause | Checks and fix |
|---|---|---|
host not found in upstream |
The service name is misspelled, Nginx and the backend are on different networks, or the proxy started with the intended network absent. | Compare proxy_pass with the Compose service key, inspect docker network inspect edge, attach both services to that network, recreate them, then run nginx -t and reload. |
connect() failed (111: Connection refused) |
The application is not ready, listens on another internal port, or binds only to loopback inside its container. | Test http://service:port from the Nginx container, inspect the application’s listening address, and configure it to listen on the container interface (often 0.0.0.0) and the port used by proxy_pass. |
502 Bad Gateway |
Nginx reached the network destination, but the application reset the connection, failed while processing it, or returned an unusable response. | Read both Nginx and application logs, make a direct internal request, and check health, startup migrations, upstream timeouts, and response headers. |
| The wrong site answers | The request’s Host header does not match server_name, or another server block is the default for that listening address. |
Test with the intended host header, verify DNS, list the loaded configuration, and define an intentional default server that rejects unknown hosts instead of serving a private application. |
| WebSocket disconnects or stalled streams | Upgrade headers are missing, HTTP/1.1 is not enabled for the location, buffering interferes with streaming, or the read timeout is too short. | Add the upgrade settings shown above, test the handshake, and tune timeout and buffering values for that endpoint. |
When a recreated container keeps an old address
Do not copy a container IP into Nginx configuration. Container IPs are implementation details and can change whenever Compose recreates a service. If a service was recreated and Nginx continues using an old resolved address, verify the service name, recreate or reload Nginx so it resolves the current address, and investigate whether your deployment requires a deliberate DNS-resolver strategy.
Compare common deployment architectures
| Architecture | TLS termination | Network isolation | Configuration model | Best fit | Main trade-off |
|---|---|---|---|---|---|
| Hand-written Nginx in one Compose project | Nginx or an upstream load balancer | Can use one edge network plus private application networks | Files reviewed and edited by people | Small and medium deployments that need explicit, auditable routing | You must maintain server blocks, reloads, and certificate renewal. |
| Hand-written Nginx with an external network | Nginx or an upstream load balancer | Shared edge network spans projects; each project can retain private networks | Separate Compose files with a common network contract | Teams that deploy the proxy and applications independently | Network creation, naming, and lifecycle must be coordinated. |
| Configuration generated from container metadata | Depends on the generator and certificate setup | Proxy and backends still need a shared Docker network | Automation watches container state and writes or reloads Nginx configuration | Frequent service changes and many similar virtual hosts | Less direct review of generated output and another automation component to operate. |
| Dedicated external load balancer in front of Nginx | Often the load balancer | Nginx can remain private to the load balancer and backend networks | Routing split between two control planes | High-availability or multi-host environments | More moving parts and more complicated forwarded-header and certificate ownership. |
Regardless of the architecture, the fundamental rule does not change: the proxy must have a network path to the backend, and the upstream name in the configuration must resolve within that path.
Quick Recap
Operational and security practices
- Publish only 80 and 443 on the proxy unless an operational requirement justifies another host port.
- Mount configuration and certificates read-only where possible, and keep private keys out of images and source repositories.
- Run
nginx -tbefore every reload. A failed test should stop the deployment rather than replace a working configuration. - Use version-controlled files and review each new
server_name, upstream, redirect, and access rule. - Give each backend a health check and monitor both Nginx status codes and application health. A healthy container process is not necessarily a healthy HTTP service.
- Set client body limits, request timeouts, and access controls according to the application. Defaults that are harmless for a small site may be unsuitable for uploads or APIs.
- Define an explicit catch-all server that returns an error for unknown hostnames so an accidental DNS record does not expose the first configured application.
- Forward the client context once, consistently. If another trusted proxy is in front of Nginx, document which hop is allowed to supply each forwarded header.
Deployment checklist
- The backend and Nginx list the same user-defined or external Docker network.
proxy_passuses the Compose service name and the port on which the application listens inside its container.- Backend ports are not published to the host unless direct access is intentional.
- Every hostname has the correct
server_name, and unknown hosts cannot fall through to a sensitive site. - Host, client-IP, forwarded-for, and forwarded-protocol headers are set for proxied requests.
- TLS certificates are mounted at the paths used by the HTTPS server block, and renewal is followed by a syntax test and reload.
docker compose exec nginx nginx -tsucceeds before each reload.- Internal requests from the Nginx container resolve the service name and receive an application response.
- Nginx and application logs are checked together after deployment.
- WebSocket, streaming, upload, and long-running endpoints have location-specific protocol, buffering, size, and timeout settings.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
