Networks

Docker networks give containers DNS names and isolated communication. Compose services usually call each other by service name on an internal bridge network; host access requires deliberate port publishing.

					services:
  api:
    build: .
    ports:
      - "3000:3000"
  db:
    image: postgres:16
    # no host publish — internal only
				

Inside a container, `localhost` refers to that container — not the host and not sibling services. Use the service name (`postgres`, `redis`) as the hostname on the compose network.

On interviews: bridge networks, published ports, localhost confusion, DNS names, and separating internal traffic from public exposure.

Common pitfalls: publishing database or admin ports to the host; hard-coding `127.0.0.1` for dependencies inside compose.

The trade-off is easy host debugging (many published ports) versus smaller attack surface and realistic networking.

Checklist:

• Use service names for internal calls.
• Publish only needed ports.
• Separate internal and external traffic.
• Document which URLs work on host vs inside the network.