CASE STUDY / 02
Containerized Services & Secure Networking
A Raspberry Pi 5 self-hosted platform designed for repeatable service deployment, protected remote access and network-wide DNS filtering without exposed inbound ports.
Useful services with a deliberately small attack surface
The platform was built to operate multiple self-hosted services on compact hardware while keeping deployment repeatable and remote access controlled. The design avoids direct inbound port exposure and adds DNS-level filtering for clients on the local network.
Controlled ingress into a container service plane
Remote traffic enters through an outbound-established tunnel, while container definitions and persistent service data remain on the managed host.
Security and operational choices
No exposed inbound ports
Remote access uses an outbound-established tunnel rather than opening services directly to the public internet.
Declarative services
Docker Compose keeps service definitions, dependencies and networks understandable and repeatable.
DNS filtering
AdGuard Home provides network-wide filtering and a central point for observing DNS requests.
The platform provides a compact, reproducible base for self-hosted services with controlled remote access, container separation and centralized DNS filtering.
Public details exclude tunnel identifiers, internal addressing, credentials and service-specific configuration.