CL-0008: network_mode: host — risks and alternatives¶

Severity: HIGH

Derivation (see severity model):

Baseline: A — the attacker already has code execution in this container, as the workload uid
Precondition: Technique — the host network namespace is handed over immediately, but turning that into impact takes a published technique: packet capture, ARP spoofing, or abusing a service that trusts 127.0.0.1
Impact: Cross-container — the reach is every interface and every other container's routed traffic, plus host-loopback services. It is a pivot, not host control
Qualifier/modifier: none
Derived: Technique × Cross-container = HIGH
Shipped: HIGH
Evidence: _cl0008 — a host-network container sees the host's interfaces, verified live

References: - OWASP Docker Security Rule #5 - CIS Docker Benchmark 5.10 — Ensure that the host's network namespace is not shared

What it detects¶

Any service with network_mode: host. Other network modes (bridge, service:, custom networks) are not flagged.

Why it matters¶

Host network mode disables Docker's network isolation entirely. The container:

Shares the host's IP address and all network interfaces
Can bind to any port on the host without publishing
Can observe and capture all host network traffic
Can communicate with services bound to 127.0.0.1 on the host
Bypasses Docker network policies and inter-container firewalling

This is a significant isolation bypass — any network-based security boundary between the container and the host is removed.

Fix¶

Remove network_mode: host and use bridge networking with explicit port mappings:

services:
  web:
    image: nginx:1.27-alpine
    ports:
      - "127.0.0.1:8080:8080"
    networks:
      - app-network

networks:
  app-network:

For most workloads, Docker's default bridge driver is the right answer. There is some NAT/iptables overhead — connection-rate ceilings and a few percent of latency on small packets — but the isolation boundary is worth it. Only workloads that genuinely need to see host traffic (network monitoring, certain VPN agents, eBPF-based tools) require host networking.

network_mode: host is also the most-extreme version of CL-0005's iptables-bypass concern: port-publish rules don't apply, so anything the container binds is on the host's interfaces directly. UFW / firewalld will not protect those bindings.

When to suppress¶

Network-monitoring sidecars (cAdvisor, node-exporter, Netdata) that legitimately need host-namespace visibility.
Userspace VPN agents that manage host routing tables.

In both cases suppress with a reason: naming the workload, and pair with cap_drop, read_only, and no-new-privileges to harden whatever isolation remains.

ATT&CK coverage¶

Remediating this finding contributes to mitigating the following MITRE ATT&CK techniques (pinned to ATT&CK v18). compose-lint is a static analyser, so this is mitigation coverage — it detects nothing at runtime.

Technique	Tactic
T1046 Network Service Discovery	Discovery