diff --git a/compose.yaml b/compose.yaml
index da1a0c9..88d8473 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -2,12 +2,18 @@ services:
   postgres:
     image: postgres:17-bookworm
     container_name: xymedia-postgres
+    labels: &xymedia-managed-labels
+      com.xymediavault.managed: "true"
+      com.xymediavault.instance_id: "${XYMEDIA_INSTANCE_ID}"
+      com.xymediavault.install_dir: "${XYMEDIA_INSTALL_DIR}"
     profiles: [local-db]
     environment:
       POSTGRES_DB: ${XYMEDIA_POSTGRES_DATABASE}
       POSTGRES_USER: ${XYMEDIA_POSTGRES_USER}
       POSTGRES_PASSWORD_FILE: /run/secrets/xymedia-postgres-password
     secrets: [xymedia-postgres-password]
+    ports:
+      - "${XYMEDIA_POSTGRES_BIND_ADDRESS:-0.0.0.0}:${XYMEDIA_POSTGRES_PUBLIC_PORT}:5432"
     volumes: ["${XYMEDIA_INSTALL_DIR}/data/postgres:/var/lib/postgresql/data"]
     healthcheck:
       test: [CMD-SHELL, "pg_isready -U ${XYMEDIA_POSTGRES_USER} -d ${XYMEDIA_POSTGRES_DATABASE}"]
@@ -17,13 +23,20 @@ services:
   app:
     image: ${XYMEDIA_BOOTSTRAP_IMAGE:-git.keeper.work/admin/xymediavault-bootstrap:1}
     container_name: xymedia-app
+    labels: *xymedia-managed-labels
     entrypoint: [/usr/bin/tini, --]
     command: [/releases/current/bin/xymedia-supervisor, --releases-dir, /releases, --config, /app/config.yaml]
     environment:
       XYMEDIA_POSTGRES_MODE: external
+      XYMEDIA_POSTGRES_HOST: ${XYMEDIA_POSTGRES_HOST}
+      XYMEDIA_POSTGRES_PORT: ${XYMEDIA_POSTGRES_PORT}
+      XYMEDIA_POSTGRES_DATABASE: ${XYMEDIA_POSTGRES_DATABASE}
+      XYMEDIA_POSTGRES_USER: ${XYMEDIA_POSTGRES_USER}
       XYMEDIA_COMPONENT_RUNTIME: local
       XYMEDIA_WEB_DIR: /releases/current/web/dist
       XYMEDIA_XIAOYA_CONTROLLER_KEY_FILE: /run/secrets/xiaoya-controller-token
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
     ports:
       - "${XYMEDIA_API_PORT:-18080}:8080"
       - "${XYMEDIA_WEBDAV_PORT:-18081}:8081"
@@ -41,6 +54,10 @@ services:
     image: xiaoyaliu/alist:latest
     profiles: [xiaoya]
     container_name: ${XYMEDIA_XIAOYA_CONTAINER:-xymedia-xiaoya}
+    labels:
+      com.xymediavault.managed: "${XYMEDIA_XIAOYA_MANAGED:-false}"
+      com.xymediavault.instance_id: "${XYMEDIA_INSTANCE_ID}"
+      com.xymediavault.install_dir: "${XYMEDIA_INSTALL_DIR}"
     ports: ["5678:80", "2345:2345", "2346:2346"]
     volumes:
       - "${XYMEDIA_XIAOYA_DATA_DIR:-${XYMEDIA_INSTALL_DIR}/xiaoya}:/data"
@@ -50,6 +67,7 @@ services:
     image: debian:bookworm-slim
     profiles: [xiaoya-control]
     container_name: xymedia-controller
+    labels: *xymedia-managed-labels
     entrypoint: [/controller/xymedia-edge]
     command: [controller]
     environment:
@@ -71,17 +89,25 @@ services:
   aliyuntvtoken:
     image: ddsderek/xiaoya-glue:python
     container_name: xymedia-aliyuntvtoken
+    labels: *xymedia-managed-labels
     profiles: [xiaoya]
     command: [python, /aliyuntvtoken/alitoken2.py, --qrcode_mode, web]
     restart: unless-stopped
   app-migrate:
-    # Ephemeral migration runs receive a unique xymedia-app-migrate-* name from install.sh.
+    # Migrations are ephemeral and use the Compose-generated project name.
     image: ${XYMEDIA_BOOTSTRAP_IMAGE:-git.keeper.work/admin/xymediavault-bootstrap:1}
+    labels: *xymedia-managed-labels
     entrypoint: [/releases/current/bin/xymediavault]
     command: [migrate, --new, --config, /app/config.yaml]
     environment:
       XYMEDIA_POSTGRES_MODE: external
+      XYMEDIA_POSTGRES_HOST: ${XYMEDIA_POSTGRES_HOST}
+      XYMEDIA_POSTGRES_PORT: ${XYMEDIA_POSTGRES_PORT}
+      XYMEDIA_POSTGRES_DATABASE: ${XYMEDIA_POSTGRES_DATABASE}
+      XYMEDIA_POSTGRES_USER: ${XYMEDIA_POSTGRES_USER}
       XYMEDIA_EXTERNAL_MIGRATION_CONFIRM: ${XYMEDIA_EXTERNAL_MIGRATION_CONFIRM:-YES}
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
     volumes:
       - "${XYMEDIA_INSTALL_DIR}/data:/app/data"
       - "${XYMEDIA_INSTALL_DIR}/releases:/releases:ro"