How to make docker only use a private network to communicate with other hosts?

At its simplest, you can bind a container to a specific network at runtime. For example, the nginx container exposes port 80. To bind that to port 8080 on your Droplet’s private network, run:

docker run -p priv.net.ip.addr:8080:80 nginx

Docker also provides many more complex networking options. For a high level overview, see:

• The Docker Ecosystem: Networking and Communication

For a deeper dive, take a look at “Understand Docker container networks” from the Docker docs.

Using some of the concepts covered there, you could also create a new bridge network that is available over your private IP address. For example,

docker network create  -o "com.docker.network.bridge.host_binding_ipv4"="priv.net.ip.addr" privnet

Now to specify that a container should use this new bridge network instead of using docker0, run it with:

docker run --net=privnet -p 8080:80 nginx