惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

N
Netflix TechBlog - Medium
J
Java Code Geeks
爱范儿
爱范儿
雷峰网
雷峰网
OSCHINA 社区最新新闻
OSCHINA 社区最新新闻
Cyber Security Advisories - MS-ISAC
Cyber Security Advisories - MS-ISAC
博
博客园 - 三生石上(FineUI控件)
H
Hackread – Cybersecurity News, Data Breaches, AI and More
B
Blog RSS Feed
Google DeepMind News
Google DeepMind News
Jina AI
Jina AI
The GitHub Blog
The GitHub Blog
I
InfoQ
月光博客
月光博客
博
博客园 - 聂微东
博
博客园 - Franky
The Cloudflare Blog
阮一峰的网络日志
阮一峰的网络日志
博
博客园_首页
G
Google Developers Blog
Blog — PlanetScale
Blog — PlanetScale
L
LangChain Blog
罗
罗磊的独立博客
Apple Machine Learning Research
Apple Machine Learning Research

DEV Community

Authentication Security Deep Dive: From Brute Force to Salted Hashing (With Java Examples) Why AI Systems Don’t Fail — They Drift Spilling beans for how i learn for exam😁"Reinforcement Learning Cheat Sheet" I Replaced Chrome with Safari for AI Browser Automation. Here's What Broke (and What Finally Worked) How Python Borrows Other People's Work The $40 Architecture: Processing 1 Billion API Requests with 99.99% Uptime Vibe Coding: A Workflow Guide (From Zero to SaaS) Most webhook security guides protect the wrong side. The scary part is delivery. Headless CMS for TanStack Start: Build a Blog with Cosmic EU Age Verification App "Hacked in 2 Minutes" — What Actually Happened Comfy Cloud’s delete function does not actually remove files Running AI Models on GPU Cloud Servers: A Beginner Guide Event-driven media intelligence with AWS Step Functions and Bedrock I scored 500 AI prompts across 8 quality dimensions — here's what broke How to Call Google Gemini API from Next.js (Free Tier, No Backend Needed) The Portal Protocol: Reclaiming Human Connection in the Age of AI How to Fix Your Team's Scattered Knowledge Problem With a Self-Hosted Forum Intro to tc Cloud Functors: A Graph-First Mental Model for the Modern Cloud Designing Multi-Tenant Backends With Both Ownership and Team Access I Built a Neumorphic CSS Library with 77+ Components — Here's What I Learned PostgreSQL Performance Optimization: Why Connection Pooling Is Critical at Scale Cómo construí un SaaS multi-rubro para gestionar expensas en Argentina con FastAPI + Vue 3 🚀 I Built an Ethical Hacking Scanner Tool – Open Source Project I Replaced /usage and /context in Claude Code With a Single Statusline A Pythonic Way to Handle Emails (IMAP/SMTP) with Auto-Discovery and AI-Ready Design I Collected 8.9 Million Polymarket Price Points — Here's What I Found About How Markets Really Move EcoTrack AI — Carbon Footprint Tracker & Dashboard Everyone's Using AI. No One Agrees How. 5 self-hosted ebook managers worth trying in 2026 Building Your First AI Agent with LangChain: From Chatbot to Autonomous Assistant
How to Expose Your Docker App Securely with Cloudflare Tu...
Mercy Chelan · 2026-05-15 · via DEV Community

Every time you forward a port on your router, you crack open a door to the internet. Anyone scanning your IP can knock on it, and some will.

There is a better way.

Cloudflare Tunnel creates a secure, outbound-only connection between your local server and Cloudflare's edge network. No open ports. No static IP. No firewall rules. Your app becomes reachable at your custom domain, fully encrypted, completely free.

I recently migrated to a new domain and used this exact setup to get my Dockerized React + Django + Nginx stack live in under an hour. This guide walks you through every step.

By the end, your app will be live at your domain with zero exposed ports and zero cost.

Cloudflare Tunnel

Prerequisites

  • A Cloudflare account (free)
  • A domain added to Cloudflare (nameservers pointed to Cloudflare)
  • Your application running inside Docker
  • cloudflared service running in Docker
  • Basic terminal knowledge

Step 1: Add Your Domain to Cloudflare

  1. Log in to Cloudflare and click Add domain
  2. Enter your domain > select the Free plan > click Continue
  3. Cloudflare scans for existing DNS records. Review, remove irrelevant ones, and continue

Update nameservers at your registrar:

Cloudflare gives you two nameservers, for example:

xyz.ns.cloudflare.com
abc.ns.cloudflare.com

Enter fullscreen mode Exit fullscreen mode

Go to your domain registrar (wherever you bought your domain), find DNS/Nameserver settings, and replace the current nameservers with these two. Wait for Cloudflare to confirm the domain is Active.

Step 2: DNS Records

Since you are using Cloudflare Tunnel (cloudflared), you do NOT need A records pointing to your server IP. The tunnel handles all routing. CNAME records are created automatically in Step 7.

Step 3: Install cloudflared 

# Add Cloudflare's package signing key
sudo mkdir -p --mode=0755 /usr/share/keyrings
curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg | sudo tee /usr/share/keyrings/cloudflare-main.gpg >/dev/null

# Add Cloudflare's apt repo
echo "deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/cloudflared any main" | sudo tee /etc/apt/sources.list.d/cloudflared.list

# Update and install
sudo apt-get update && sudo apt-get install cloudflared

Enter fullscreen mode Exit fullscreen mode

Step 4: Authenticate cloudflared 

cloudflared tunnel login

Enter fullscreen mode Exit fullscreen mode

This prints a URL. Open it in your browser, select your domain, and a cert.pem file is saved to ~/.cloudflared/cert.pem.

Note: This cert is your account-level credential. Keep it safe. It is only needed on the host for management commands, not inside your Docker container.

Step 5: Create the Tunnel 

cloudflared tunnel create tunnel-name

Enter fullscreen mode Exit fullscreen mode

Output:

Created tunnel tunnel-name with id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
Tunnel credentials written to ~/.cloudflared/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx.json

Enter fullscreen mode Exit fullscreen mode

Save the tunnel UUID, you need it in the next step.

Copy the credentials to your project:

cp ~/.cloudflared/*.json .cloudflared/

Enter fullscreen mode Exit fullscreen mode

Step 6: Create the Configuration File

Inside your .cloudflared directory, create a config.yml file. This file tells the tunnel which local service to route traffic to for each hostname.

tunnel: <YOUR-TUNNEL-UUID>
credentials-file: /etc/cloudflared/<YOUR-TUNNEL-UUID>.json

ingress:
  # Route your primary domain to Nginx on port 443
  - hostname: example.com
    service: https://nginx:443

  # Route www subdomain to the same service
  - hostname: www.example.com
    service: https://nginx:443

  # Catch-all rule. required, must be last
  - service: http_status:404

Enter fullscreen mode Exit fullscreen mode

For a full list of configuration options, type this command in your terminal:

cloudflared tunnel help

Enter fullscreen mode Exit fullscreen mode

Note: Not using Nginx? Replace https://nginx:443 with http://localhost:8000 (or your app's port). The catch-all rule is required, cloudflared throws an error without it.

Validate your rules:

cloudflared tunnel --config .cloudflared/config.yml ingress validate
# Expected: OK

Enter fullscreen mode Exit fullscreen mode

Step 7: Route Traffic to Your Domain 

# Point root domain to the tunnel (auto-creates CNAME in Cloudflare DNS)
cloudflared tunnel route dns tunnel-name example.com

# Point www subdomain
cloudflared tunnel route dns tunnel-name www.example.com

Enter fullscreen mode Exit fullscreen mode

Confirm in the Cloudflare dashboard under DNS > Records:

Type    Name    Content                          Proxy
CNAME   @       <tunnel-uuid>.cfargotunnel.com   Proxied
CNAME   www     <tunnel-uuid>.cfargotunnel.com   Proxied

Enter fullscreen mode Exit fullscreen mode

Test routing:

cloudflared tunnel --config .cloudflared/config.yml ingress rule https://example.com
# Expected: Matched rule #0

Enter fullscreen mode Exit fullscreen mode

Step 8: Add cloudflared to docker-compose.yml 

cloudflared:
  image: cloudflare/cloudflared
  restart: unless-stopped
  command: tunnel --config /etc/cloudflared/config.yml run
  user: "nonroot"
  dns:
    - 1.1.1.1
    - 1.0.0.1
  volumes:
    - ./.cloudflared:/etc/cloudflared

Enter fullscreen mode Exit fullscreen mode

Step 9: Set File Permissions

The nonroot user inside the container needs read access to the credentials:

chmod 600 .cloudflared/*.json
chmod 644 .cloudflared/config.yml

Enter fullscreen mode Exit fullscreen mode

Tip: If the container still can't read the JSON file after 600, try 644. This is a common issue depending on how Docker volume mounts are configured on your system.

Step 10: Start and Verify 

# Start the container
docker compose up cloudflared -d

# Watch the logs
docker compose logs cloudflared -f

Enter fullscreen mode Exit fullscreen mode

A healthy connection looks like:

INF Registered tunnel connection connIndex=0 ...
INF Registered tunnel connection connIndex=1 ...

Enter fullscreen mode Exit fullscreen mode

Check tunnel health in the Cloudflare dashboard under Access > Networks > Connectors. Your tunnel should show a green Healthy status.

Common Issues and How to Fix Them

1. Tunnel shows "Degraded" or "Offline"

The cloudflared container cannot read the credentials file.

ls -la .cloudflared/
chmod 644 .cloudflared/*.json
docker compose restart cloudflared
docker compose logs cloudflared -f

Enter fullscreen mode Exit fullscreen mode

2. ingress validate passes but traffic returns 404

Your catch-all rule is missing or misplaced. It must be last with no hostname:

ingress:
  - hostname: example.com
    service: https://nginx:443
  - service: http_status:404   # must be last, no hostname

Enter fullscreen mode Exit fullscreen mode

3. cert.pem errors after a long period

The cert expires after inactivity. Re-run this to refresh it without affecting your tunnel or DNS:

cloudflared tunnel login

Enter fullscreen mode Exit fullscreen mode

Conclusion

You now have a production-ready, zero-cost tunnel connecting your custom domain to a locally running Docker stack, no open ports, no exposed IPs, no monthly bill.

This setup scales further than you might think. You can add more hostname entries to expose multiple services through the same tunnel, set up Cloudflare Access policies to password-protect specific routes, or layer on Cloudflare's WAF and DDoS protection, all from the same free account.

If something broke along the way, drop your error in the comments. And if everything worked, what are you running behind your tunnel? I'd love to see what you're building.

References

此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。