Compose network segmentation
Separate front and back networks
Lesson 18 of 20 · 12 min · Module 6: Operate a complete stack
A stack can describe which services should share each communication boundary.
Start this lesson →Free. No installation: you write and run the code in your browser, and it is checked automatically.
By the end, you’ll be able to…
- Draw the necessary relationships
- Attach each service intentionally
The idea
Compose describes services and their relationships as YAML mappings and sequences. Read the whole service graph, including access and storage boundaries.
01Draw the necessary relationships
The proxy needs api; api needs cache. The proxy does not need to share a network with cache merely because all three belong to one application.
02Attach each service intentionally
Compose network lists describe membership. An explicit network assignment replaces the implicit default membership for that service.
03Treat segmentation as one control
An internal network restricts external connectivity at that network boundary. Authentication, authorization, updates, and host protection remain separate responsibilities.
Your turn
What the checks look for
- Proxy stays on front
- API connects both layers
- Cache stays on an internal back network
Take this with you
Design communication paths from the relationships the application actually needs.
Go a little further
Add a worker that needs cache but should not be reachable from the proxy network.