Container-to-Container Communication

Start reading

LEVEL 0

The Problem

You’ve learned about networks and DNS. But let’s see it in action with a real multi-container application.

You’re building a web application:

A frontend container (React/Vue/Angular)
A backend API container (Node.js/Python/Go)
A database container (PostgreSQL/MySQL)

These containers need to talk to each other. The frontend needs to call the API. The API needs to query the database.

How do you set this up so they can communicate reliably, even when containers restart and IPs change?

LEVEL 2

The Mechanics — Setting Up Multi-Container Communication

The Mechanics

Create a custom network:

docker network create app-network

Start the database:

docker run -d \
  --name database \
  --network app-network \
  -e MYSQL_ROOT_PASSWORD=secret \
  -e MYSQL_DATABASE=myapp \
  mysql:8

Start the backend API:

docker run -d \
  --name api \
  --network app-network \
  -e DATABASE_HOST=database \
  -e DATABASE_NAME=myapp \
  my-api-image

Notice: The backend connects to DATABASE_HOST=database. It uses the container name, not an IP address.

Start the frontend:

docker run -d \
  --name frontend \
  --network app-network \
  -p 8080:80 \
  -e API_URL=http://api:3000 \
  my-frontend-image

Notice: The frontend connects to API_URL=http://api:3000. Again, using the container name.

How it works:

Frontend makes a request to http://api:3000
DNS lookup: “api” → Docker’s DNS returns 172.18.0.3 (API container’s IP)
Request goes to the API container
API queries database:3306
DNS lookup: “database” → Docker’s DNS returns 172.18.0.2
API connects to the database

All using names, not hardcoded IPs.

LEVEL 3

Communication Patterns

Pattern 1: Chain of requests

User → Frontend (port 8080) → API (port 3000) → Database (port 3306)

Only the frontend is exposed to the host (via -p 8080:80). The API and database are internal.

Pattern 2: Shared network

All containers on app-network can reach each other using names.

Pattern 3: Multiple networks for security

# Create two networks
docker network create frontend-tier
docker network create backend-tier

# Frontend only on frontend-tier
docker run -d --name frontend --network frontend-tier -p 8080:80 my-frontend

# API on both tiers (bridge between them)
docker run -d --name api --network frontend-tier my-api
docker network connect backend-tier api

# Database only on backend-tier
docker run -d --name database --network backend-tier mysql:8

Now:

Frontend can reach API (both on frontend-tier)
API can reach Database (both on backend-tier)
Frontend CANNOT reach Database directly (not on the same network)

This is the principle of least privilege—containers only have access to what they need.

LEVEL 4

Testing Container Communication

Exec into a container and test:

# From the API container, ping the database
docker exec api ping -c 3 database
# Works! DNS resolves "database" to its IP

# Try a port test
docker exec api nc -zv database 3306
# Connection to database 3306 port [tcp/mysql] succeeded!

# From the frontend, try to reach the API
docker exec frontend curl http://api:3000/health
# {"status": "ok"}

View DNS resolution:

docker exec api nslookup database

You’ll see Docker’s DNS (127.0.0.11) resolving “database” to its IP.