So Outside Technology Security CMS
AnQiCMS
Online Demonstration

When deploying a content system in container mode, what should be confirmed first: port mapping and data backup?

📅 2026-11-01 👁️ 0

What needs to be confirmed first for container deployment of the content management system, port mapping and data backup? The sequence is three steps: first, confirm which port the exposed image is mapped to on the host machine, then confirm whether the upload directory and database are outside the container, and finally confirm that the backup can truly recover. Taking the AnQiCMS Docker image as an exampleanqicms/anqicmsFor example, the application listens to the default port 8001, this step needs to be set in advance before starting the container, rather than changing it after it starts.

Three things need to be determined before deployment.

The first thing is the port form. The default listening port 8001 is the application port inside the container, the public network access is usually handled by a reverse proxy, which transfers 80 and 443 into it. It is rare to expose 8001 directly to the public network, most of the time, the proxy is placed in front, and the proxy terminates the certificate and jump.

The second thing is the data landing point. The container is disposable, and the content in the image will be overwritten when rebuilt, so the backup copies of uploaded images, attachments, and template modifications should point to the mounted directory. The third thing is the backup ownership: the backup is produced by the on-site function, but the product should be placed outside the container, otherwise, once rebuilt, both the program and the backup will be lost.

How to write port mapping and reverse proxy

After confirming the mapping relationship, you still need to check which header information the proxy has forwarded. The application generates absolute addresses and depends on these headers to judge the source protocol, and if the forwarding is missing, it will cause the address configured in the background to be inconsistent with the actual access address from the front-end. The static rules at this level also need to align: the rewriting rules within the container and the forwarding path at the proxy layer should follow the same set of conventions, otherwise, the front-end page can be accessed, but the address in the sitemap cannot be accessed.

Inspection items The position to be confirmed outside the container The behavior after an error
Application port The mapping relationship between the container internal port 8001 and the host port The proxy is reachable but the background link points to the wrong port
Forwarding header Proxy layer protocol and source hostname setting The generated resource address becomes http or points to the intranet
Static rules The rule file and proxy forwarding path are consistent List page is accessible, detail page reports 404
Upload directory Mounted to the host machine or object storage persistent volume The newly uploaded image is lost after the container is rebuilt
Backup product The storage location of data backup and static file backup Backup is deleted along with the program

Data must be stored outside the container

There are two common practices for databases: using the database service inside the container, or connecting to an external database. The former must mount the data directory, otherwise it will be lost after restart; the latter must strip the connection configuration from the image to avoid rebuilding the image when changing environments. The same is true for the upload directory and configuration files, any content that needs to be effective after modification or needs to be redone if lost should be in the persistent volume.

Multiple site scenarios require an extra layer of attention. AnQiCMS supports multi-site management, with a single program managing multiple independent sites. At this point, the container boundary and the site boundary are not the same thing: a single container carrying multiple sites means that a single rebuild will affect all sites, so how many sites to host on each host machine should be allocated according to risk at the deployment stage, rather than merging when capacity is tight.

The backup must be able to really recover.

The backup capability within the site covers two types of products: data and static files. The check method involves a full recovery process rather than just checking if the files exist: start the same version image on an isolated machine, mount a clean directory, put the backup in and restore it, then check if the homepage, list page, and an article with images can normally access the resources. After the recovery is complete, it is convenient to check the 301 redirect configuration, as the redirection of the old address after the address change is part of the front-end experience.

Websites deployed on operation and maintenance panels such as Baota Panel or aaPanel, and also confirm whether the scheduled tasks of the panel conflict with container rebuilds: If the backup path of the panel points to a temporary directory inside the container, the output will be an empty directory snapshot.

Common questions

Question: Do you need to back up the template files modified in the container separately?Answer: Template modifications belong to content outside the container. You can write it in the mounted directory and back it up with the data; if you modify it directly in the image, it will be lost during rebuild.

Question: Can the default port 8001 be used directly externally?Answer: It can be done but is not recommended. The external port is handed over to the reverse proxy, the application port is only accessible within the internal network, and certificates and redirects are all handled at the proxy layer.

Question: How should we handle the recovery when multiple sites share a single container?Answer: Check separately whether the data and static files of each site are complete. After recovery, visit each site's homepage and representative page one by one to confirm that the addresses and redirects do not overlap.

Question: Why do we need to confirm the pseudo-static in the container an extra time?Answer: The rule files within the container and the forwarding of the proxy layer are two configurations. If they are not aligned at either place, it will result in the page being accessible, but failing when retrieving addresses according to the site map.

Related articles

How to connect the translation process when the two Chinese and English sites share the same backend

When the Chinese and English sites share the same backend, first configure the multi-language sites and switches, then process the content: existing pages use whole-page HTML translation to take over, new content is created separately by language, consistency of terminology relies on keyword library and site-wide replacement, and updates of the two sets of content use the same process for synchronization.

2026-11-01

What should be done before upgrading to the new version?

Before upgrading, do two things: back up the data along with the static files and confirm that they can be restored, write down the upgrade window and rollback path. For versions involving security fixes, you also need to rotate the site signature key and change all admin passwords after the upgrade. Upgrading itself is not enough to clear the attacker's existing sessions.

2026-11-01

Is the free quota of the message form verification code enough?

Determine if the free quota is sufficient, first calculate your actual monthly submission volume instead of the access volume. The free tier of the plan charged by the number of evaluations is up to 10,000 times per month, not based on the access volume; another type of interactive verification plan is unlimited in the number of challenges, but limited in the scale of access. This article provides an estimation method, access sequence, and fallback plan, and explains how to handle submissions that cannot be blocked using in-app review and email reminders.

2026-11-01

How long will it take for a new page without active push to be indexed by search engines?

When a new page does not perform active push, the time for inclusion depends on the speed at which the search engine discovers it, usually one order of magnitude slower than the submission push. This article explains that active push solves the timeliness of notification, and site map solves the master list, both of which cannot be substituted for each other, and provides the order of access to in-site link push, Baidu push, and Bing submission interface, as well as the method of checking the ratio of repeated push to inclusion.

2026-11-01

The running environment needs to switch to a new version line, can I take a server for gray-scale testing first and then cut over to the full scale

When changing the version line of the running environment, you can first take a server with the same configuration as production for gray release, and then switch in batches. There are three prerequisites: the gray release copy is consistent with the production configuration, the version line expiration time is confirmed, and the rollback can be restarted on the original version line. This article explains how to cut gray release batches, monitor three types of compatibility differences, and the operation sequence of switching and rolling back.

2026-11-01

The contact form is flooded with spam submissions, should you add honey trap fields first or implement captcha verification first.

When a form is flooded with spam submissions, first add hidden honey pot fields, and then decide whether to implement CAPTCHA based on the remaining spam volume. Honey pots are effective against script submissions that do not parse styles and do not disturb real visitors; CAPTCHA has a cost, as it will block a portion of real users. In the statistics checked that day, robots accounted for forty-five percent of global network traffic, and more than half of the form submissions without protection were spam. The two layers should be implemented sequentially rather than simultaneously.

2026-11-01

The security patches and system upgrades for the operating environment are due at the same time, which step should be done first?

When the environment security patch and the content system upgrade coincide with the same maintenance window, first patch the high-risk operating environment patches, and then schedule the content system upgrade, and first verify compatibility on the copy. This article explains the differences in nature of the two updates, the reasons for sorting, and the minimum operational steps and rollback preparation within the window.

2026-11-01

Which item should be inspected first for backup and recovery before merging multiple sites into a batch of domain names?

Before merging multiple sites into a new domain batch, backup and recovery must be accepted first to ensure clean recovery: Confirm that the backup covers the database and static files, and then perform a real recovery drill in an isolated environment before discussing address switching, 301 redirects, and site map reconstruction.

2026-11-01