Isolate Services with Compose Networks

Labs have no container engine, so nothing is built or started: your files are checked by reading them, the way a reviewer or a CI linter would. docker-compose config (to validate Compose files) and hadolint (a Dockerfile linter) are installed.

All services in /home/student/projects/invoicer/compose.yaml share the default network, so the internet-facing proxy can talk to db directly.

Task

• Define two networks: frontend and backend. backend must be internal (no route to the outside world).
• proxy is only on frontend; db is only on backend; api is on both.
• proxy keeps publishing port 443. Nothing else publishes ports.
• docker-compose config must accept the file.