Anyone have some good leads on how #docker networking works?

I think I need the ELI-5 hand-puppet version. Trying to wrap my head around whether I need to set different ports for every postgresql container I'm bringing up in a parallel dev / prod deployment on the same machine; I'd expect "they're in separate networks so they should be invisible to each other" but then these containers are also exposing the port in the host's network it seems? Because when I set the `networks` to `- backend` and `ports` to `5432:5432`, I can access that postgresql DB at localhost:5432 from the host environment.