Get Started with Docker - Part 6a: Secure Remote Access with Cloudflare Tunnel

With a short break from Homelab duties while we took a detour with AZ-802 let's take a look again at the Get Started with Docker Series

You've installed some self-hosted applications and containers on your server, and you've learned how to proxy them locally using Pi-Hole and Nginx Proxy Manager. But what happens when you want to access your homelab services securely from outside your home network?

Traditionally, people used router port forwarding (opening ports 80 and 443 ), but exposing open ports to the public internet attracts automated port scanners, botnets, and DDoS attacks.

This is where Cloudflare Tunnel ( cloudflared ) comes in. It allows you to expose your web services securely to the internet through an outbound connection to Cloudflare's global edge network—without opening a single inbound port on your home router!

We're going to:

Look at what Cloudflare Tunnel and Cloudflare Zero Trust are

Set up your persistent Docker Config folders ( Files/AppData/Config/cloudflared )

Create a Cloudflare Tunnel in the Cloudflare Zero Trust Dashboard

Create our Docker Compose file using Nano Text Editor

Spin up the cloudflared daemon in Docker Compose

Create a Zero-Trust Access Policy with Email OTP MFA and Geo-IP filtering

Test accessing a local container service securely from the internet

What's Cloudflare Tunnel ( cloudflared )?

Cloudflare Tunnel establishes an encrypted, outbound-only connection between a lightweight daemon running in a Docker container on your server ( cloudflared ) and Cloudflare's edge network.

Because the connection is initiated outbound from inside your network:

No Inbound Open Ports: You don't need to touch your router's port forwarding settings.

Hide Your Home IP Address: Public DNS queries point to Cloudflare's proxy IP addresses, masking your residential WAN IP address completely.

Built-in DDoS Protection: Traffic is filtered by Cloudflare before it ever reaches your home server.

Bypassing CGNAT & No Static IP Required…