Why is that I am able to access container outside the bridge network?-CodePudding

I started mysqldb from a docker container . I was surprised that I could connect it via the localhost using the below command

mysql -uroot -proot -P3306 -h localhost

I thought the docker containers that start on the bridge network and wont be available outside that network. How is that mysql CLI is able to connect to this instance

Below is my docker compose that runs the mysqldb-docker instance

version: '3.8'
services:
  mysqldb-docker:
    image: 'mysql:8.0.27'
    restart: 'unless-stopped'
    ports:
      - "3306:3306"
    environment:
      - MYSQL_ROOT_PASSWORD=root
      - MYSQL_PASSWORD=root
      - MYSQL_DATABASE=reco-tracker-dev
    volumes:
      - mysqldb:/var/lib/mysql
  reco-tracker-docker:
    image: 'reco-tracker-docker:v1'
    ports:
      - "8083:8083"
    environment:
      - SPRING_DATASOURCE_USERNAME=root
      - SPRING_DATASOURCE_PASSWORD=root
      - SPRING_DATASOURCE_URL="jdbc:mysql://mysqldb-docker:3306/reco-tracker-dev"
    depends_on: [mysqldb-docker]
    env_file:
      - ./.env
volumes:
  mysqldb:

CodePudding user response：

You have published the port(s). That means you can reach them on the host system on the published port.

By default, when you create or run a container using docker create or docker run, it does not publish any of its ports to the outside world. To make a port available to services outside of Docker, or to Docker containers which are not connected to the container’s network, use the --publish or -p flag. This creates a firewall rule which maps a container port to a port on the Docker host to the outside world.

The critical section in your config is the below. You have added a ports key to your service. This is composes way to publish ports. The left part is the port where you publish it to on the host system. The right part is where the container actually listens on.

ports:
  - "3306:3306"

Also keep in mind that when you start compose, a default network is created that joins all container in the compose stack. That's why These containers can find each other, with the service name and/or container name as hostname.

You don't need to publish the port(s) like you did in order for them to be able to communicate. I guess that's why you did it. You can and probably should remove any port mapping from internal services, if possible. This will add extra security to your setup, because then it behaves like you describe. Only containers in the same network find each other.