Write the decision before changing the system
This guide is a planning exercise for an application operator. It does not represent a PrivacyNodes deployment, support action or measured customer result. Inventory every published container port, host listener, administrator route and deploy identity. Bind internal services to a private interface where the application design permits, and use separate credentials for the application, deployment and database.
Rehearse the change with controlled inputs
In a rehearsal, test the public API from a separate client and confirm that database and diagnostic ports are not reachable there. Docker publishing and host filtering are separate controls; document both before opening a route.
Use synthetic requests and test identities while checking the change. Do not expose secrets or customer data in a command, log excerpt or support note.
Verify the outcome and record the remaining limit
Keep an independent recovery login and a tested rollback artifact. Hardening is a continuing operating task, not a claim that an API cannot be compromised.
Capture UTC time, artifact or configuration revision, redacted symptoms and the next owner.
Official reference
This source was reviewed for the technical boundary in this guide; it does not document a PrivacyNodes test or provider capability.