I Run 85 Docker Containers as a Solo Founder. Here's the Bash That Keeps It Alive.

85 containers. 24 PostgreSQL databases. 67 domains. 232 cron jobs. One developer. 120 EUR/month in Hetzner bills. This is not a startup fantasy pitch. This is my production infrastructure for a SaaS ecosystem serving German golf clubs, a golf school management platform, a community platform, a CRM, and an auth service. Every customer gets their own database. Physical tenant isolation, not software filters. People tell me this cannot work. The containers disagree. The Stack Next.js for all frontends. Single-tenant PostgreSQL per customer (Supabase stacks). Docker on bare metal. Coolify for deployment orchestration. Traefik as the reverse proxy handling 67 domains. Two Hetzner servers in Germany. Total infrastructure cost: 120 EUR/month. The single-tenant architecture is a deliberate trade-off. Multi-tenant saves infrastructure cost, but one RLS bug exposes every customer's data. One compromised tenant enables lateral movement to all others. GDPR Article 17 deletion in multi-tenant requires complex cross-tenant queries. In single-tenant, deletion is DROP DATABASE . No residual risk. The cost is more operational complexity. Which is exactly why automation is not optional. 176 Guard Rules: The Immune System My AI agents (Claude Code with custom hooks) execute roughly 80% of daily development and operations work. That is dangerous without constraints. So I built a guard system: 176 shell scripts that fire on every command, every file edit, every session end. The architecture is simple. Four dispatchers route to context-specific guards: #!/bin/bash # Pre-Bash-Dispatcher: Loads guards based on command profile. # Not all 176 guards fire on every command. Profiling classifies # each command (git, docker, npm, database, deploy, comms) and # loads only relevant guards. set -uo pipefail GUARDS_DIR = " $( dirname " $0 " ) /guards" INPUT = $( cat ) CMD = $( echo " $INPUT " | jq -r '.tool_input.command // ""' ) # 8 security gates fire ALWAYS, non-negotiable: # tabu-gate, pii-gate,