# compose.yaml
services:
  web:
    image: nginx:alpine
  app:
    image: alpine:3.20
    command: sleep infinity

# 启动
docker compose up -d

# 查看网络
docker network ls | grep myproject
# <project>_default   bridge   local

# 查看网络详情
docker network inspect <project>_default

# 测试服务间连通性
docker compose exec app ping web
# PING web (172.18.0.x): 56 data bytes
# 64 bytes from 172.18.0.x: seq=0 ttl=64 time=0.068 ms

# compose.yaml
services:
  frontend:
    image: nginx:alpine
    networks:
      - frontend-net

  backend:
    image: node:20-alpine
    networks:
      - frontend-net
      - backend-net

  db:
    image: postgres:16-alpine
    networks:
      - backend-net

networks:
  frontend-net:
    driver: bridge
  backend-net:
    driver: bridge

networks:
  frontend-net:
    driver: bridge
    driver_opts:
      com.docker.network.bridge.name: br-frontend   # Linux 桥接接口名
      com.docker.network.bridge.enable_icc: "true"   # 容器间通信
    ipam:
      driver: default
      config:
        - subnet: 172.20.0.0/16
          ip_range: 172.20.240.0/20
          gateway: 172.20.0.1
    labels:
      - "com.example.project=myapp"
      - "com.example.environment=production"

services:
  app:
    image: myapp:latest
    networks:
      frontend-net:
        ipv4_address: 172.20.0.100     # 固定 IP
        ipv6_address: "2001:db8::100"  # IPv6
        priority: 1000                  # 出口流量优先级
        aliases:
          - myapp.local                # 网络别名（其他容器可通过此名访问）
          - api.local

# 手动创建
docker network create shared-net

# 或由另一个 Compose 项目创建
cd project-a && docker compose up -d
# project-a_default 网络被创建

# project-b/compose.yaml
services:
  api:
    image: myapi:latest
    networks:
      - shared
      - internal

networks:
  shared:
    external: true           # 声明为外部网络
    name: shared-net         # 指定外部网络名称
  internal:
    # 非外部，Compose 自动创建

# project-a/compose.yaml — 前端应用
services:
  frontend:
    image: nginx:alpine
    networks:
      - project-a-net
      - shared-net

networks:
  project-a-net:
  shared-net:
    external: true
    name: cross-project-net

# project-b/compose.yaml — 后端 API
services:
  api:
    image: node:20-alpine
    networks:
      - project-b-net
      - shared-net

networks:
  project-b-net:
  shared-net:
    external: true
    name: cross-project-net

# 创建共享网络
docker network create cross-project-net

# 分别启动两个项目
cd project-a && docker compose up -d
cd project-b && docker compose up -d

# frontend 现在可以通过 http://api:3000 访问 project-b 的 API

services:
  proxy:
    image: nginx:alpine
    network_mode: host
    # 不需要 ports 映射，直接监听宿主机端口

services:
  batch-job:
    image: alpine:3.20
    network_mode: none
    command: ["sh", "-c", "echo 'No network access' && sleep 5"]

services:
  api:
    image: myapi:latest
    # 其他容器可通过以下方式访问：
    # - http://api:3000        (服务名)
    # - http://myapp-api:3000  (项目前缀 + 服务名，取决于配置)

services:
  database:
    image: postgres:16
    networks:
      default:
        aliases:
          - db
          - postgres
          - pg.local

# 其他服务可通过任意别名连接
services:
  app:
    image: myapp:latest
    environment:
      # 以下三种写法都能解析到同一个容器
      DATABASE_URL: postgresql://user:pass@database:5432/mydb
      DATABASE_URL: postgresql://user:pass@db:5432/mydb
      DATABASE_URL: postgresql://user:[email protected]:5432/mydb

services:
  web:
    image: nginx:alpine
    links:
      - app    # 旧方式，仅保留向后兼容
  app:
    image: myapp:latest

services:
  db:
    image: postgres:16
    ports:
      # ❌ 危险：所有网络接口都可访问
      - "5432:5432"

      # ✅ 安全：仅本地访问
      - "127.0.0.1:5432:5432"

      # ✅ 安全：仅允许特定网段
      - "10.0.0.0/8:5432:5432"  # 注意：不支持 CIDR，仅单 IP

services:
  db:
    image: postgres:16
    # 不配置 ports，容器仅在 Docker 网络内可达
    # 外部无法访问

  api:
    image: myapi:latest
    ports:
      - "8080:3000"   # 仅 API 暴露到宿主机

services:
  app:
    image: myapp:latest
    network_mode: "container:existing-container-name"
    # 共享指定容器的网络栈

services:
  gateway:
    image: nginx:alpine
    networks:
      public-net:
      internal-net:
    ports:
      - "443:443"

  auth:
    image: myauth:latest
    networks:
      internal-net:
      auth-net:

  db:
    image: postgres:16
    networks:
      auth-net:
      data-net:

  cache:
    image: redis:7
    networks:
      data-net:

networks:
  public-net:
  internal-net:
  auth-net:
  data-net:

networks:
  dual-stack:
    enable_ipv6: true
    ipam:
      config:
        - subnet: 172.28.0.0/16
        - subnet: "2001:db8:abcd::/64"

# 查看所有网络
docker network ls

# 查看网络详情（含连接的容器）
docker network inspect <project>_default

# 在容器内测试连通性
docker compose exec app ping db
docker compose exec app nslookup db
docker compose exec app curl -v http://web:80

# 查看容器 IP
docker compose exec app ip addr show
docker compose inspect --format '{{.NetworkSettings.Networks}}' <service>