All through the same network, I’m afraid. I haven’t felt the need to separate it like that, although it should be doable using docker networks, or maybe on even lower level, via Linux network namespaces.