Separate ext. / int. containers
6.4.3.3. Separate external/internal containers

For security reasons it is recommended to run external web application modules like Loginapp, and internal web applications, like Adminapp in separate Docker containers.

Airlock IAM provides a mechanism for that. See 7.2. Sandboxing with profiles and the below.