Define a service for the sidecar container in the normal way, then use the 'network_mode: "service:<svc-needing-the-sidecar>"' property to ensure it shares the same network context as its partner service.