Docker: Let containers communicate to each other but don't expose to internet I was recently shocked to find out that docker writes its own iptables rules and ignores ufw bindings completely. I had blocked all ports using the ufw deny incoming command and then selectively allowed only the ports that I wanted to expose.
I have a very simple setup that utilizes a postgresql container and a simple nodejs application. My primary goal is to keep the postgresql container port off the internet but let the node backend accept requests through port 3333. How do I do that?
My current docker-compose.yml file looks like this:
version: &quot;3&quot;

services:
  redis:
    image: redis:latest
    ports:
      - 6379:6379
    command: [&quot;redis-server&quot;, &quot;/redis.conf&quot;]
    network_mode: host
  database:
    image: &quot;postgres&quot;
    env_file:
      - ./database/database.env
    volumes:
      - database-data:/var/lib/postgresql/data
      - ./database/init-db.sql:/docker-entrypoint-initdb.d/init.sql
    ports:
      - 5432:5432
    restart: always
    network_mode: host

  backend:
    depends_on: [database]
    build: ./server
    volumes:
      - ./files:/var/lib/files
    ports:
      - 3333:3333
    restart: always
    network_mode: host

volumes:
  database-data:
If you're looking to access your database only from localhost, you can do something like that:
    ports:
      - &quot;127.0.0.1:5432:5432&quot;