Docker networks let containers communicate. On the same user-defined network, they reach each other by service name. Port mapping (-p host:container) publishes a port to the outside; internal services do not need to be exposed.
Example
The web service reaches the database at db:5432 on the Compose network.