Compose service runs on the host network

ID

compose_host_network

Severity

low

Remediation Complexity

trivial

Remediation Risk

medium

Remediation Effort

low

Vendor

Docker

Resource

General Security

Tags

ASVS50:v13.1.1, reachable

Description

A Docker Compose service sets network_mode: host, so it binds directly on the host’s network interfaces with no network namespace of its own. Its ports are not confined by the published-port mapping, and it can reach anything the host can reach, including services bound to loopback that were never meant to be exposed. The Compose spelling of the Kubernetes share_host_network_namespace flaw.

Reported at a lower severity than the rest of this family because a deliberate use — a network probe, a service that has to see the host’s interfaces — is not unusual.

Examples

Reported:

services:
  probe:
    image: example/probe:1.2.3
    network_mode: host

Mitigation / Fix

Use a Compose network and publish only the ports the service serves:

services:
  probe:
    image: example/probe:1.2.3
    networks: [frontend]
    ports:
      - "8080:8080"

networks:
  frontend:

© 2026 Xygeni. All rights reserved