The shop runs three containers on shop. All three publish ports, and web on 8080 returns 502. Only web should be reachable from the host.

 host :8080 ──► web ──► api :3000 ──► db :6379

See the current state:

curl -s localhost:8080
docker logs web
docker logs api

Recreate db without -p, then confirm the host can no longer reach it:

docker rm -f db
docker run -d --name db --network shop redis:7.4
curl -s localhost:6379
echo $?

api binds 127.0.0.1 unless HOST is set (see ~/shop/server.js). Recreate it listening on all interfaces, with no published port:

docker rm -f api
docker run -d --name api --network shop -e HOST=0.0.0.0 shop/inventory-api:1.0
docker logs api

nginx looked up api when it started. Restart it, then load the shop:

docker restart web
curl -s localhost:8080