The core idea

Isolated by default, connected on purpose.

Each container gets its own private network space. To reach it from outside, or to let two containers talk, you deliberately open the right connection.