Isolate service networks with Docker Compose I have two containerised services, A and B, with which I wish to isolate network communications with docker compose. There is also a shared service C which is not isolated from A or B and is free to communicate with either.

I have tried to achieve this with the following docker-compose.yaml:
version: &quot;3.3&quot;
services:
  C:
    build: C
    depends_on:
      - A
      - B
    expose:
      - 8080
    networks:
      - A
      - B
  A:
    build: A
    expose:
      - 8080
    networks:
      - A
  B:
    build: B
    expose:
      - 8080
    networks:
      - B

networks:
  A:
    internal: true
  B:
    internal: true

With this, C is able to connect to both A and B on the hosts A:8080 and B:8080 respectively and  A and B are isolated as required. However, neither A nor B is able to connect to C on C:8080. Removing the network options from the compose file, all services are able to talk to each other. What am I doing wrong?
I don't experience same issue with similar setup to what you describe. 'A' &amp; 'B' can ping &amp; access services on 'C' just fine. Few things to look at:

Port aside, can you ping 'C' from either of the other containers?
You probably shouldn't (can't?) name containers capital 'A', 'B', 'C' if you're going to build them in docker-compose. If that's what's actually used, try more meaningful names.
Does name resolution work if you do nslookup c from either a &amp; b? It should resolve via nameserver 127.0.0.11
firewall on 'C' or service not up on c:8080?