I’ve tried commenting out the ports in the compose file, which should make them only available on the internal network, I thought. But when I do that, the containers can no longer connect to each other.

Did you create an explicit network for them to talk on? Otherwise the default docker network doesn’t support internal DNS queries.

docs.docker.com/engine/network/#container-network…

Specifically you need a network using the bridge driver: docs.docker.com/engine/network/drivers/bridge/