Answers: <p>Internal Docker networks mean there is no gateway configured to reach the outside internet, you can only reach other containers from that network. In your scenario, none of your networks should have this definition.</p>
  
  <p>Without setting the internal network flag, containers can reach out of the docker host, potentially to the internet if the host has that access. This is one-way access, containers can access the external network, but that external network cannot access the containers.</p>
  
  <p>To access a container from outside of the Docker host, you need to publish the port on the host mapping into the desired container (or service). Publishing ports with the <code>ports</code> section in the <code>docker-compose.yml</code> file is only needed to provide external access, not access between containers. Applications inside containers need to listen on all interfaces (0.0.0.0) for both publishing ports on the host and for container to container communication. However, you can publish ports on a specific interface on the host, e.g.:</p>
  
  <pre><code>ports:
    - '127.0.0.1:8825:8825'
    - '127.0.0.1:8835:8835'
  </code></pre>
  
  <p>For container to container communication, it is not necessary to expose or publish the port. All that is needed is a user defined network (which you have) in common between the containers. Then the containers can communicate using Docker's built-in DNS to resolve the service name (e.g. consul and mongo) and the application port inside that container (e.g. consul:8300). To avoid the external network from accessing these containers, do not publish any ports from them.</p>
  
  <p>Side note: from your <code>docker-compose.yml</code>, you should also consider removing <code>container_name</code>, <code>depends_on</code>, and <code>build</code> since they won't work if you try to transition to swarm mode. </p>
  
Answers: CC BY-SA 4.0
Answers: 2018-07-16T13:35:43.713Z
Answers: 2018-09-16T05:34:22.313Z
Answers: 2018-09-16T05:34:22.313Z
Answers: BMitch
Body: <p>I am a newbie to Docker. 
  I am trying to run my application containing from multiple containers </p>
  
  <p>Here is my <strong>docker-compose.yml</strong> file</p>
  
  <pre><code>version: '3.3'
  services:
    php-service:
      container_name: 'php-service'
      build: './php-service'
      networks:
        - backend
      ports:
        - '8666:8666'
    go-service:
      container_name: 'go-service'
      build: './go-service'
      ports:
        - '8825:8825'
        - '8835:8835'
      volumes:
        - './go-service:/go/src/go-service'
      networks:
        - frontend
        - backend
      depends_on:
        - 'mongo'
        - 'consul'
    consul:
      image: 'consul:latest'
      networks:
        - backend
      ports:
        - "8300:8300"
        - "8400:8400"
        - "8500:8500"
        - "8600:53/udp"
    mongo:
      image: 'mongo:latest'
      container_name: 'mongo'
      networks:
        - backend
      ports:
        - '27100:27017'
  
  networks:
    frontend:
      internal: false
    backend:
      internal: true
  </code></pre>
  
  <p>What I want to achieve.</p>
  
  <p>The Outside World - is a network space of a hosting machine where the Docker daemon is running.</p>
  
  <ol>
  <li><p>Go-Service, PHP-Service, Consul and Mongo Db communicate over internal network not exposed to the outer world. Let's call this network <strong>backend</strong>. </p></li>
  <li><p>I want services inside <strong>backend</strong> network to be able to send outgoing requests to outer world</p></li>
  <li><p>Another network is for the outside world, I need to expose only specific ports. In my case I want to expose 8825 and 8835 only. So that ports will be exposed as <strong>localhost:8825</strong> and <strong>localhost:8835</strong> on the hosting machine</p></li>
  </ol>
  
  <p>Is it possible to get the desired configuration? </p>
  
  <p>Or maybe I am doing something wrong, please suggest any other good way to achieve this.</p>
  
  <p>Thank you so much</p>
  
Tags: <docker><docker-compose><networking>
Title: Internal network between container Docker Compose with outgoing connection
UserDisplayName: solderingiron
ThreadText: # Internal network between container Docker Compose with outgoing connection
  
  (Asked by: username_0 on 2018-07-14)
  
  I am a newbie to Docker.
  I am trying to run my application containing from multiple containers
  
  Here is my **docker-compose.yml** file
  
  ```
  version: '3.3'
  services:
    php-service:
      container_name: 'php-service'
      build: './php-service'
      networks:
        - backend
      ports:
        - '8666:8666'
    go-service:
      container_name: 'go-service'
      build: './go-service'
      ports:
        - '8825:8825'
        - '8835:8835'
      volumes:
        - './go-service:/go/src/go-service'
      networks:
        - frontend
        - backend
      depends_on:
        - 'mongo'
        - 'consul'
    consul:
      image: 'consul:latest'
      networks:
        - backend
      ports:
        - "8300:8300"
        - "8400:8400"
        - "8500:8500"
        - "8600:53/udp"
    mongo:
      image: 'mongo:latest'
      container_name: 'mongo'
      networks:
        - backend
      ports:
        - '27100:27017'
  
  networks:
    frontend:
      internal: false
    backend:
      internal: true
  
  ```
  
  What I want to achieve.
  
  The Outside World - is a network space of a hosting machine where the Docker daemon is running.
  
  1. Go-Service, PHP-Service, Consul and Mongo Db communicate over internal network not exposed to the outer world. Let's call this network **backend**.
  2. I want services inside **backend** network to be able to send outgoing requests to outer world
  3. Another network is for the outside world, I need to expose only specific ports. In my case I want to expose 8825 and 8835 only. So that ports will be exposed as **localhost:8825** and **localhost:8835** on the hosting machine
  
  Is it possible to get the desired configuration?
  
  Or maybe I am doing something wrong, please suggest any other good way to achieve this.
  
  Thank you so much
  
  **Tags:** docker, docker-compose, networking
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2018-07-16. Score: 8
  
  Internal Docker networks mean there is no gateway configured to reach the outside internet, you can only reach other containers from that network. In your scenario, none of your networks should have this definition.
  
  Without setting the internal network flag, containers can reach out of the docker host, potentially to the internet if the host has that access. This is one-way access, containers can access the external network, but that external network cannot access the containers.
  
  To access a container from outside of the Docker host, you need to publish the port on the host mapping into the desired container (or service). Publishing ports with the `ports` section in the `docker-compose.yml` file is only needed to provide external access, not access between containers. Applications inside containers need to listen on all interfaces (0.0.0.0) for both publishing ports on the host and for container to container communication. However, you can publish ports on a specific interface on the host, e.g.:
  
  ```
  ports:
    - '127.0.0.1:8825:8825'
    - '127.0.0.1:8835:8835'
  
  ```
  
  For container to container communication, it is not necessary to expose or publish the port. All that is needed is a user defined network (which you have) in common between the containers. Then the containers can communicate using Docker's built-in DNS to resolve the service name (e.g. consul and mongo) and the application port inside that container (e.g. consul:8300). To avoid the external network from accessing these containers, do not publish any ports from them.
  
  Side note: from your `docker-compose.yml`, you should also consider removing `container_name`, `depends_on`, and `build` since they won't work if you try to transition to swarm mode.
  
  
  ---
  
  