Supporting custom Docker Compose looked simple when I first thought about it:

let the user paste a docker-compose.yml ;

save it on the VPS;

run docker compose up -d ;

celebrate. 🎉

The problem is that a Compose file is not just a list of containers.

It can mount the host filesystem, join the host network, access devices, add Linux capabilities, reuse another application's network, publish arbitrary ports, or mount the Docker socket—which is effectively control over the Docker host.

So the real workflow cannot be this:

Compose file ──────────────────────────► Docker daemon

Enter fullscreen mode

Exit fullscreen mode

It needs a boundary in the middle:

Compose file │ ▼ ┌──────────────────────────────┐ │ Parse → Normalize → Inspect │ │ Transform → Resolve → Check │ └──────────────────────────────┘ │ │ │ accepted └────► refused with a reason ▼ Docker daemon

Enter fullscreen mode

Exit fullscreen mode

This is the problem behind the Compose safety policy in Nitrobase.

Nitrobase has only recently…