Agent Wranglers

Recommended

Put each container only on the networks it needs

Split containers into networks by who must talk to whom. Put the database on an internal network that only the app joins.

By Agent Wranglers. Updated .

How to do it

Compose puts every service on one default network, so each container can reach every other one. Declare a front network for the proxy and the app, and a back network for the app and the database. Mark the back network internal: true, which cuts it off from outside traffic. A taken-over proxy then cannot reach the database. Never run apps on Docker's default bridge, where unrelated containers can reach each other. This is the container version of Limit where servers can send traffic.

Examples

Using these examples: they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

YAML example

services:
  proxy:
    networks: [front]
  app:
    networks: [front, back]
  db:
    image: postgres:17.11-alpine
    networks: [back]
networks:
  front: {}
  back:
    internal: true

Shell example

docker network create --internal back
docker run -d --network back --name db postgres:17.11-alpine

How to check

A connection test from the proxy container to the database port fails, and the same test from the app container succeeds. docker network inspect shows "Internal": true for the back network.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/operations/containers/container-networks">Agent Wranglers operations playbook</a>. In code you write, add a comment next to it with the same link.