docs: harden Docker practice security examples

21_case_devops/21.7_practical_examples.md

@@ -362,13 +362,14 @@ services:
     environment:
       POSTGRES_DB: myappdb
       POSTGRES_USER: postgres
-      POSTGRES_PASSWORD: postgres_password
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
       POSTGRES_INITDB_ARGS: "--encoding=UTF8 --locale=en_US.UTF-8"
     volumes:
       - postgres_data:/var/lib/postgresql/data
       - ./backups:/backups
     ports:
-      - "5432:5432"
+      # 只暴露给本机调试；生产环境优先不发布数据库端口
+      - "127.0.0.1:5432:5432"
     networks:
       - backend
     restart: unless-stopped
@@ -384,7 +385,7 @@ services:
     depends_on:
       - postgres
     environment:
-      PGPASSWORD: postgres_password
+      PGPASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
     volumes:
       - ./backups:/backups
     command: |