4. Container Networking and Volumes

Containers are ephemeral, so important data should live in named volumes or external services rather than only in a writable container layer. Docker networks provide service discovery by container name and isolate traffic between groups of services.

Use published ports only for traffic that must cross the host boundary. A Compose network can let an API reach postgres:5432 internally without exposing PostgreSQL to the public host interface.