Networking in Coolify
Coolify separates public traffic from private container traffic. HTTP and HTTPS requests enter through the Coolify Proxy container on the server running the resource, while applications, databases, and services communicate over Docker networks.
Understanding these paths makes domains, ports, destinations, and proxy settings easier to configure.
The three networking paths
Most Coolify networking decisions belong to one of three paths.
A domain is the normal path for a web application or HTTP service. Use private networking for dependencies such as databases. Map a port to the server only when a client must connect directly or the protocol does not belong behind the HTTP proxy.
How public traffic reaches a resource
Coolify configures the route, but the Coolify instance does not relay application traffic. The request goes to the Coolify Proxy container on the server where the resource runs.
The application must listen on the port configured for the resource. For example, if an application listens on port 3000 inside its container, the Coolify Proxy container must target port 3000 even though visitors connect over the standard HTTPS port 443.
Applications and services can use domains. Databases use private networking by default and can be exposed separately with a public database port when an external client must connect.
How private container traffic works
A destination represents a Docker network on a connected server. On a standalone server, Coolify creates an attachable Docker network named coolify during setup. The coolify network is the default destination, and Coolify deploys non-Docker Compose applications to it unless you select another destination.
The Coolify Proxy container joins the coolify network and the resource-specific networks used by Docker Compose applications and service stacks. This allows the Coolify Proxy container to reach containers that have public routes. Other containers on a shared network can communicate directly through their container or service name, a network alias, and the internal port where the dependency listens.
Common private paths include:
- an application connecting to a database on its database port
- one service container calling another by its Docker Compose service name
- the Coolify Proxy container forwarding a domain request to an application port
Private traffic does not need a public domain, a public IP address, or a host port mapping. Resources on separate Docker networks remain isolated unless you connect them to a shared network.
Docker Compose applications and service stacks use their own resource-specific network by default and do not join the coolify network automatically. Enable Connect To Predefined Network when the stack must reach another resource through its Coolify destination. Read Docker Compose networking before changing that connection.
Choose a proxy model
Coolify supports two integrated proxies, Traefik and Caddy, plus Custom (None). Coolify selects Traefik by default when you add a server. You can select Caddy instead and keep Coolify-managed routing and TLS certificates, or bring your own proxy with Custom (None) and manage the entire public traffic path yourself.
A direct host port mapping bypasses the proxy. It exposes the selected container port through the server, so you must choose a free host port and restrict it with the appropriate firewall rules. Application port mappings also disable rolling updates for that application.
The networking responsibility boundary
The same boundary applies to self-hosted Coolify and Coolify Cloud: resources run on servers you provide. When you self-host, you also operate the network path to the Coolify instance itself.
When a connection fails, trace the path in order. For a domain, check DNS, the firewall, Coolify Proxy container status, the generated route, the shared Docker network, and the container port. For a private dependency, check the shared network, internal hostname, internal port, and credentials.
Continue with networking
Use the detailed guides for the part of the path you need to configure.
Configure domains
Use Domains to configure DNS records, HTTPS, target ports, paths, redirects, and generated domains.