I agree it should be in a VM and it would be great to put that in the documentation, but the reality usually is that your CI/CD tool will already have very elev

I agree it should be in a VM and it would be great to put that in the documentation, but the reality usually is that your CI/CD tool will already have very elevated access to your infra. The people deploying using docker compose are usually not the kind of people that have tightly scoped deployment credentials. If someone can get into your CD system, they can almost certainly run arbitrary code on your production machines.