The Compose hardening checklist we grade Field Labs against

No root containers, no exposed database ports, and the stack must survive a restart without losing data. These three rules catch almost every mistake we see in early submissions.