Docker – Overlay Network Driver – One leader for two clusters

At the docker host level, overlay networking is implemented by gossip over :7946/* and :4789/udp for overlay traffic. Every node needs to be able to reach every other node.

However, each overlay network is a virtual network that works much like a NAT in terms of its assignment and routing. The default overlay network driver assigns addresses out of the 10.0.0.0/8 pool in /24 partitions.

So, to ensure that, in terms of overlay networking, Java can communicate with both nginx and databases, but databases cannot be connected from nginx you could declare something similar to this:

networks:
  nginx:
  database:

services:
  nginx:
    image: nginx
    networks:
    - nginx

  java:
    image: java
    networks:
    - nginx
    - database

  database:
    image: mysql
    networks:
    - database

Because we have explicitly attached nginx and java to an nginx network, those containers will share addresses on a – for example – 10.0.1.0/24 network and will be able to route to, and discover each other via dns.

Likewise java will have a 2nd virtual network interface, and share addresses with the database on a 10.0.2.0/24 network.

Nginx and the database however, have a single network interface each, attached to different overlay networks. Overlay networks are routable to the internet, but not each other, so they cannot communicate directly.