Private networking
Why your app and database should talk over the private network, not the public internet.
Every project gets its own private network. Any database you attach to it is reachable by your app over that network — not over the public internet, even though both are running on the same platform.
Why this matters
A connection over the private network skips everything a public connection has to do: DNS resolution, a TLS handshake, and a trip through a public port and firewall — for every single query, not just once per session. In practice this is the difference between a database call adding a few tens of milliseconds and adding under one.
It also means your database has no public attack surface by default. There's no port to scan, no credential to brute-force from outside, because there's no path in from outside at all unless you explicitly open one.
What's on the private network
- Your app containers
- Databases you've attached to the project
Nothing outside your project can reach into it, and your project can't reach into someone else's.
When you need a public connection
Connecting from your own computer, a BI tool, or a service outside DockHosting needs the public path — see Connect from your computer. That's the exception, not the default; your app itself should always use the private connection string it's given automatically.
Not the same as a firewall
The private network and the IP firewall solve different problems. The private network means there's no public port at all. The firewall restricts who can use a public port once you've decided to open one. Use the private network as the default, and the firewall on top of any public access you do turn on.