How to run Node.js and Python in Docker on a VPS: practical guide

Update the system and install dependencies:

sudo apt update
sudo apt install -y ca-certificates curl gnupg lsb-release

These dependencies are prerequisites to add the repository with a verified GPG key — don’t skip this step, otherwise apt will refuse the repo.

Add Docker’s official GPG key:

sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | \
  sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
sudo chmod a+r /etc/apt/keyrings/docker.gpg

Configure the repository and install Docker Engine + Compose plugin:

echo "deb [arch=$(dpkg --print-architecture) \
  signed-by=/etc/apt/keyrings/docker.gpg] \
  https://download.docker.com/linux/ubuntu \
  $(lsb_release -cs) stable" | \
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

sudo apt update
sudo apt install -y docker-ce docker-ce-cli containerd.io \
  docker-buildx-plugin docker-compose-plugin

Add your user to the docker group to avoid using sudo:

sudo usermod -aG docker $USER
newgrp docker
docker run --rm hello-world

The hello-world confirms the daemon is running and your user has permission. If you see “Hello from Docker!”, you’re good.

In the root directory of your Node project, create a Dockerfile:

# Stage 1: build
FROM node:22-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .

# Stage 2: runtime
FROM node:22-alpine
WORKDIR /app
RUN addgroup -g 1001 -S nodejs && \
    adduser -S nodeapp -u 1001
COPY --from=builder --chown=nodeapp:nodejs /app /app
USER nodeapp
EXPOSE 3000
CMD ["node", "server.js"]

The node:22-alpine image weighs ~45 MB versus ~380 MB for node:22. The non-root user (nodeapp) is defense-in-depth — if the application is compromised, the attacker doesn’t have root inside the container.

Create a .dockerignore to shrink the build context:

node_modules
npm-debug.log
.git
.env
.env.*
dist
coverage
*.md

Without this, Docker copies your local node_modules (which can be 500 MB+) into the build context, making the build slow and the image bloated.

Create the Dockerfile in the Python project directory:

FROM python:3.12-slim AS builder
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir --user -r requirements.txt

FROM python:3.12-slim
WORKDIR /app
RUN useradd -m -u 1001 pyapp
COPY --from=builder /root/.local /home/pyapp/.local
COPY --chown=pyapp:pyapp . .
USER pyapp
ENV PATH=/home/pyapp/.local/bin:$PATH
ENV PYTHONUNBUFFERED=1
EXPOSE 8000
CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000"]

The PYTHONUNBUFFERED=1 flag forces stdout/stderr to flush without buffering — without it, logs stay stuck in memory and only show up when the process dies, which makes debugging in production hard.

At the root of the directory containing both applications, create docker-compose.yml:

services:
  api-node:
    build: ./node-app
    container_name: api-node
    restart: unless-stopped
    networks:
      - backend
    ports:
      - "3000:3000"
    environment:
      - NODE_ENV=production
      - DATABASE_URL=postgres://app:secret@db:5432/appdb
    depends_on:
      - db

  api-python:
    build: ./python-app
    container_name: api-python
    restart: unless-stopped
    networks:
      - backend
    ports:
      - "8000:8000"
    environment:
      - DATABASE_URL=postgresql://app:secret@db:5432/appdb
    depends_on:
      - db

  db:
    image: postgres:16-alpine
    container_name: postgres-db
    restart: unless-stopped
    networks:
      - backend
    environment:
      - POSTGRES_USER=app
      - POSTGRES_PASSWORD=secret
      - POSTGRES_DB=appdb
    volumes:
      - postgres-data:/var/lib/postgresql/data

networks:
  backend:
    driver: bridge

volumes:
  postgres-data:

Both applications share the backend network and reach the database by the name db (Docker’s internal DNS). Named volumes persist database data between docker compose down and up.

Bring the whole stack up:

docker compose up -d --build
docker compose ps
docker compose logs -f api-node

The -d flag runs in the background, --build rebuilds images if the Dockerfiles changed. logs -f follows the output in real time — Ctrl+C exits the follow without stopping the container.

Test the HTTP endpoints from the VPS:

curl -i http://localhost:3000/health
curl -i http://localhost:8000/health

Each should return HTTP/1.1 200 OK with your application’s payload. If it returns Connection refused, the container isn’t listening on the expected port — check docker compose logs <service>.

Validate that everything comes up on its own after reboot:

sudo reboot

After reconnecting via SSH (wait 30-60s), run docker compose ps. The containers should be Up because of restart: unless-stopped. If not, the docker.service may not be enabled at boot — fix it with sudo systemctl enable docker.