Connect Docker containers on a network

Containers on the same user-defined Docker network can reach one another by service or container name and the container port. They should not use localhost to reach a sibling container; inside a container, localhost means that same container.

docker network create app-net
docker run -d --name db --network app-net -e POSTGRES_PASSWORD=dev-only postgres:16
# an application on app-net connects to host db and PostgreSQL's container port

A published port such as -p 127.0.0.1:8080:80 is for reaching a container from the host. It is not required for two containers on the same network. Compose creates a project network automatically, so a service can connect to db:5432 when the database service is named db.

Use docker network inspect app-net to diagnose membership and aliases. Keep databases off public interfaces unless that exposure is intentional, restrict published ports to the needed host address, and use application credentials rather than treating network reachability as authentication.

Sources

• Docker documentation
• Docker CLI reference