How should Docker networking be implemented for production?

Expose only entry-point ports, keep internal dependencies on private networks, use service names instead of hardcoded IP addresses, and document ingress and egress requirements.