INF-77Recommended

Put each container only on the networks it needs

Split containers into networks by who must talk to whom. Put the database on an internal network that only the app joins.

By Agent Wranglers. Updated 27 October 2026.

How to do it

Compose puts every service on one default network, so each container can reach every other one. Declare a front network for the proxy and the app, and a back network for the app and the database. Mark the back network internal: true, which cuts it off from outside traffic. A taken-over proxy then cannot reach the database. Never run apps on Docker's default bridge, where unrelated containers can reach each other. This is the container version of Limit where servers can send traffic.

Examples

YAML example

services:
  proxy:
    networks: [front]
  app:
    networks: [front, back]
  db:
    image: postgres:17.11-alpine
    networks: [back]
networks:
  front: {}
  back:
    internal: true

Shell example

docker network create --internal back
docker run -d --network back --name db postgres:17.11-alpine

How to check

A connection test from the proxy container to the database port fails, and the same test from the app container succeeds. docker network inspect shows "Internal": true for the back network.

Sources

INF-32 Limit where servers can send traffic in Infrastructure and environments
INF-81 Deny pod traffic by default with network policies in Infrastructure and environments

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration/container-networks">Agent Wranglers infrastructure and environments playbook</a>. In code you write, add a comment next to it with the same link.