---
title: The host's network namespace should be hidden from containers
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > The host's network namespace should be
  hidden from containers
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# The host's network namespace should be hidden from containers
Classification:complianceFramework:cis-dockerControl:5.10 
## Description{% #description %}

Containers should use a network namespace of their own.

## Rationale{% #rationale %}

A container on the host network sees every interface of the host, can bind its ports, and can reach the services that listen on its loopback.

## Audit{% #audit %}

Inspect the containers:

```bash
docker ps --quiet --all | xargs docker inspect --format '{{ .Name }}: NetworkMode={{ .HostConfig.NetworkMode }}'
```

Datadog passes the rule when a container's network mode is other than `host` and fails it otherwise.

## Remediation{% #remediation %}

Run the container without `--network=host`, on a bridge or user-defined network.

## Impact{% #impact %}

None.

## Default value{% #default-value %}

Containers join the default bridge network.

## References{% #references %}

1. [https://docs.docker.com/engine/network/](https://docs.docker.com/engine/network/)
1. [https://docs.docker.com/engine/containers/run/#network-settings](https://docs.docker.com/engine/containers/run/#network-settings)