Metadata

Id: dockercompose-shared-host-network-namespace

Platform: DockerCompose

Severity: Medium

Category: Resource Management

Learn More

• Provider Reference

Description

Setting network_mode: host places a container directly on the host’s network stack, removing all network isolation and exposing every host network interface, port, and routing table to the container. This can allow a compromised container to intercept or inject traffic on any host network interface and expose services bound to loopback addresses. Services should use Docker-managed networks rather than host networking.

Compliant Code Examples

services:
  bridge:
    image: alpine
    network_mode: bridge
  default:
    image: alpine

Non-Compliant Code Examples

services:
  risky:
    image: alpine
    network_mode: host