Boto3 timeout connecting to local dynamodb but can curl

Question

I have been attempting to follow the various instructions and troubleshooting to get a docker container to connect to another docker container running local dynamodb via boto3. References/troubleshooting so far:

• In compose, can just use automatic linking. Incidentally I tried explicitly specifying a shared network but could not succeed this way.
• Make sure to use the resource name from compose, not localhost
• Github repo with a template

Dockerfile (docker build -t min-example:latest .):

FROM python:3.8

RUN pip install boto3

RUN mkdir /app
COPY min_example.py /app
WORKDIR /app

Docker compose (min-example.yml):

version: "3.3"

services:

  db:
    container_name: db
    image: amazon/dynamodb-local
    ports:
      - "8000:8000"

  app:
    image: min-example:latest
    container_name: app
    depends_on:
      - db

min_example.py

import boto3


if __name__ == '__main__':
    ddb = boto3.resource('dynamodb',
                         endpoint_url='http://db:8000',
                         region_name='dummy',
                         aws_access_key_id='dummy',
                         aws_secret_access_key='dummy')
    existing_tables = [t.name for t in list(ddb.tables.all())]
    print(existing_tables)
    existing_tables = [t.name for t in list(ddb.tables.all())]
    print(existing_tables)

Run with

docker-compose run -f min-example.yml app python min_example.py

It hangs on the ddb.tables.all() call, and times out with the error:

botocore.exceptions.ReadTimeoutError: Read timeout on endpoint URL: "http://db:8000/"

Interestingly, I can curl:

docker-compose -f min-example.yml run app curl http://db:8000/

{"__type":"com.amazonaws.dynamodb.v20120810#MissingAuthenticationToken","message":"Request must contain either a valid (registered) AWS access key ID or X.509 certificate."}

Which suggests the containers can communicate.