How To Self-Host a Ghost Blog With Docker Compose

Ghost is an open-source publishing platform focused on blogging and newsletters — a lighter, more opinionated alternative to a general-purpose CMS like WordPress. The Ghost project maintains an official Docker image and documents a standard self-hosting pattern for it: Ghost runs in one container and talks to a MySQL database in a second container, both defined together in a single docker-compose.yml. This tutorial walks through that exact pattern — from an empty project directory to a TLS-terminated blog with verified, persistent content.

This tutorial assumes Docker Engine and the Docker Compose plugin are already installed. If you plan to serve the blog on a real public domain, it also assumes Nginx and Certbot are already set up on the server (see the earlier reverse-proxy tutorial in this series) and that you have a domain — for example blog.example.com — with a DNS A record pointed at your server's public IP. If you're only testing locally, you can skip the reverse-proxy step and reach Ghost directly on port 2368.

Step 1 — Create a Project Directory

Docker Compose projects are easiest to manage from a dedicated directory that holds just the compose file and nothing else. Create one under /opt, which is the conventional location for self-installed application data on Linux:

sudo mkdir -p /opt/ghost
cd /opt/ghost

Step 2 — Define the Docker Compose Configuration

Create docker-compose.yml in that directory with two services: db (MySQL 8) and ghost (Ghost 5 on Alpine, a small base image). Each has a named volume so its data survives container recreation — db_data for MySQL's data directory, ghost_data for Ghost's content directory (themes, images, and its own SQLite-free config).

services:
  db:
    image: mysql:8
    restart: unless-stopped
    environment:
      - MYSQL_ROOT_PASSWORD=a_strong_root_password
      - MYSQL_DATABASE=ghost
    volumes:
      - db_data:/var/lib/mysql

  ghost:
    image: ghost:5-alpine
    restart: unless-stopped
    ports:
      - "2368:2368"
    environment:
      - database__client=mysql
      - database__connection__host=db
      - database__connection__user=root
      - database__connection__password=a_strong_root_password
      - database__connection__database=ghost
      - url=https://blog.example.com
    volumes:
      - ghost_data:/var/lib/ghost/content
    depends_on:
      - db

volumes:
  db_data:
  ghost_data:

Two details are worth noting. First, image tags are pinned to major versions (mysql:8, ghost:5-alpine) rather than left as latest — this avoids an unattended minor/major upgrade breaking Ghost's database schema on a routine docker compose pull. Second, the db service deliberately has no ports: entry at all. MySQL only needs to be reachable from the ghost container over Docker's internal network (they can resolve each other by service name — that's why database__connection__host=db works), and it should never be exposed to the host or the internet.