diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
index e17f1964..f1349d54 100644
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -18,13 +18,13 @@ The "why": Enables rapid, standardized deployment of 200+ OSS apps on Dokploy wi
 
 - `meta.json`: Array of template objects. Always process after edits using `node dedupe-and-sort-meta.js` to remove duplicates (by `id`) and sort alphabetically.
 - `blueprints/<service>/`:
-  - `docker-compose.yml`: Standard Docker Compose v3.8. Avoid `ports`, `container_name`, `networks`—Dokploy handles isolation via internal networks.
+  - `docker-compose.yml`: Standard Docker Compose v3.8. **NEVER use `ports` with host port mappings**—use `expose` only. Avoid `container_name`, `networks`—Dokploy handles isolation via internal networks.
   - `template.toml`: Defines variables (e.g., `${domain}`), domains (service:port → host), env vars, and mounts. Use helpers like `${password:32}`, `${uuid}`, `${jwt:secret_var}`.
   - `logo.svg/png`: Service icon, referenced in `meta.json`.
 - `dedupe-and-sort-meta.js`: Standalone script—reads `meta.json`, removes duplicate `id`s (keeps first), sorts by `id` (case-insensitive), creates timestamped backup.
 - `build-scripts/process-meta.js`: Advanced processor with CLI options (`--verbose`, `--no-backup`, `--input`/`--output`), JSON schema validation (required: `id`, `name`, `version`, `description`, `links.github`, `logo`, `tags` array).
 
-Exemplary blueprint: `blueprints/ghost/`—`docker-compose.yml` exposes port 2368; `template.toml` maps domain to Ghost service; meta entry tags as ["blogging", "cms"].
+Exemplary blueprint: `blueprints/ghost/`—`docker-compose.yml` uses `expose: ["2368"]` for port exposure; `template.toml` maps domain to Ghost service; meta entry tags as ["blogging", "cms"].
 
 ## Development Workflow
 
@@ -33,7 +33,7 @@ Exemplary blueprint: `blueprints/ghost/`—`docker-compose.yml` exposes port 236
    - **REQUIREMENT**: Service **MUST** be open source. Only add templates for applications with an open-source license (e.g., MIT, Apache, GPL, AGPL). Proprietary or closed-source services are not allowed.
    - **Verify Docker Images**: Before using any Docker image in `docker-compose.yml`, verify it exists using `docker manifest inspect <image:tag>` (e.g., `docker manifest inspect docker.io/bitnami/discourse:3.5.0`). This ensures the image is available and prevents deployment failures.
    - Create `blueprints/<id>/` (e.g., `ghost`).
-   - Implement `docker-compose.yml` (single service typical; use volumes for persistence).
+   - Implement `docker-compose.yml` (single service typical; use `expose` for ports, volumes for persistence).
    - Configure `template.toml`—reference vars in `[config.domains]`, `[config.env]`, `[config.mounts]`.
    - Add/update `meta.json` entry with exact `id` matching folder.
    - Run `node dedupe-and-sort-meta.js --backup` to validate/sort.
@@ -49,7 +49,10 @@ No tests in repo—focus on manual validation via scripts and Dokploy deploys. D
 
 - **Open Source Requirement**: **ALL services MUST be open source**. Only applications with open-source licenses (MIT, Apache, GPL, AGPL, etc.) are allowed. Proprietary or closed-source services are strictly prohibited.
 - **Template IDs**: Lowercase, kebab-case (e.g., `active-pieces`); unique across repo—enforced by dedupe script.
-- **Docker Compose**: Minimal—omit `ports` (Dokploy proxies), persistent volumes (e.g., `- db-data:/var/lib/postgresql/data`). Services named after folder (e.g., `ghost` service).
+- **Docker Compose**: 
+  - **Port Mappings**: **NEVER use `ports` with host port mappings** (e.g., `"8080:8080"`)—**always use `expose` only** (e.g., `expose: ["8080"]`). Dokploy handles port proxying via its internal reverse proxy, so host port bindings are unnecessary and create potential port conflicts. This applies to ALL blueprints; some older templates may still incorrectly use `ports` and should be updated to use `expose` instead.
+  - Use persistent volumes for data storage (e.g., `- db-data:/var/lib/postgresql/data`). 
+  - Services named after folder (e.g., `ghost` service).
 - **template.toml**:
   - Variables: `[variables] main_domain = "${domain}"`; use helpers for secrets (`${password:64}`, `${base64:32}`).
   - Domains: `[[config.domains]] serviceName = "<service>" port = 80 host = "${main_domain}"` (path="/" optional).