ReviseAlgo Logo

Docker Compose — Multi-Container Apps

Networking Between Services in Docker Compose

Automatic network setup and domain name sharing.

Interview: Understand service discovery in Docker Compose. Interviewers will ask: how does Service A resolve the address of Service B? Be ready to explain the automatic creation of a default bridge network, embedded DNS resolution, and network segmentation (e.g., placing frontends and backends on isolated subnets).

Last Updated: June 15, 2026 • 15 min read

Introduction

When you start a Docker Compose stack, Compose automatically creates a new isolated bridge network (typically named <project_name>_default). Every service defined in the docker-compose.yml file joins this network. This gives them private IP addresses within that subnet and enables instant container-to-container communication.

Why It Matters

Microservices must connect to database servers, caches, and queues securely. Hardcoding IP addresses fails because Docker assigns IPs dynamically on container reboot. DNS-based service discovery ensures that containers can find each other reliably using names.

Real-World Analogy

A private network in Docker Compose is like an internal office intercom system. Every desk (container) has a phone extension named after their job title (e.g. database, cache). When the web server wants to contact the database, they don't need to know the database worker's cell phone number; they just dial database on the intercom, and Docker's internal switchboard connects them automatically.

How It Works

Within a Compose bridge network, containers do not need to look up or store hardcoded IP addresses:

  1. Docker runs an embedded DNS server at 127.0.0.11 inside every container.
  2. When Service A requests a connection to host database, it queries the local DNS server.
  3. The DNS server returns the active private IP address of the container named database.

Internal Architecture

Docker manages internal bridge networks using virtual ethernet pairs (veth) and host bridge devices. When a packet leaves a container destined for another container, it travels through the veth interface to the host bridge, which routes it directly to the target container's interface without exiting the host networking stack.

Visual Explanation

Loading diagram…

Practical Example

Here is how to configure segmented networks to isolate databases from public ingress proxy gateways:

Common Mistakes

1. Missing Subnet Links: If you place the frontend app on public_net and the database on database_net, and forget to place the backend app on both networks, the backend won't be able to route requests to the database, throwing connection host unreachable errors.
2. Default Host Binding: Believing that service name resolution works from the physical host machine. The service names (e.g. database) only resolve inside the container network.

Quick Quiz

Q1: If Service A resides on Network X, and Service B resides on Network Y, how can they communicate via DNS hostnames?

A) They cannot communicate unless one container joins both networks.

B) Docker DNS automatically links all subnets on the host.

C) They must use the host's public IP address.

Answer: A — Containers can only resolve and route traffic to other containers if they share at least one virtual network subnet.

Scenario-Based Challenge

Scenario:

You run an API service that needs to query a Redis cache. You want to make sure the database engine cannot be accessed by the Redis cache under any circumstances. How do you design the networks in Compose?

View Solution

Create two separate networks: cache_net and db_net.
1. Bind the Redis cache container exclusively to cache_net.
2. Bind the Database container exclusively to db_net.
3. Bind the API service container to both cache_net and db_net.
This isolates Redis from the database, preventing any routing between them, while letting the API communicate with both.

Debugging Exercise

Failure Case:

A container throws java.net.UnknownHostException: database on startup. The developer states the service is named database in the YAML file.

How would you debug this?

View Solution
Check if the services are on different networks. If you declare networks explicitly in Compose, the default bridge is disabled.

Verification: Run docker network inspect on the compose networks. Ensure both containers share a common network. If one has network fields, they must both declare that network to enable resolve path lookup.

Interview Questions

1. How does Service A resolve the IP address of Service B inside Docker Compose?

Docker intercepts DNS requests within the containers at the virtual IP 127.0.0.11, resolving the service identifier (e.g. B) to B's active container IP on the shared bridge.

2. What is network segmentation and how is it implemented in Docker Compose?

It is the practice of splitting containers into multiple distinct networks to block unwanted traffic routes. It is configured by creating multiple named networks and registering only relevant containers to each.

Production Considerations

Use custom driver options in network declarations to allocate specific CIDR blocks or connect Compose networks to external hosts using overlay drivers or bridge macvlan adapters.