---
title: "Put each container only on the networks it · Agent Wranglers"
url: https://agentwranglers.se/playbook/operations/containers/container-networks
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Put each container only on the networks it needs

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Containers](https://agentwranglers.se/playbook/operations/containers.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

- Level: Recommended
- Chapter: [Containers](https://agentwranglers.se/playbook/operations/containers)
- Rule: Split containers into networks by who must talk to whom. Put the database on an internal network that only the app joins.
- How: Compose puts every service on one default network, so each container can reach every other one. Declare a front network for the proxy and the app, and a back network for the app and the database. Mark the back network `internal: true`, which cuts it off from outside traffic. A taken-over proxy then cannot reach the database. Never run apps on Docker's default bridge, where unrelated containers can reach each other. This is the container version of [Limit where servers can send traffic](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/egress-control).
- Check: A connection test from the proxy container to the database port fails, and the same test from the app container succeeds. `docker network inspect` shows `"Internal": true` for the back network.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### YAML example

```yaml
services:
  proxy:
    networks: [front]
  app:
    networks: [front, back]
  db:
    image: postgres:17.11-alpine
    networks: [back]
networks:
  front: {}
  back:
    internal: true
```

### Shell example

```sh
docker network create --internal back
docker run -d --network back --name db postgres:17.11-alpine
```

## Sources

- [Compose file networks reference](https://docs.docker.com/reference/compose-file/networks/)
- [Docker bridge network driver](https://docs.docker.com/engine/network/drivers/bridge/)

## Related rules

- [Limit where servers can send traffic](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/egress-control) in Infrastructure

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/operations/containers/container-networks">Agent Wranglers operations playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Publish only the ports visitors use](https://agentwranglers.se/playbook/operations/containers/published-ports)
- Next: [Cap the size of container logs](https://agentwranglers.se/playbook/operations/containers/container-log-rotation)
- [Containers](https://agentwranglers.se/playbook/operations/containers)