Skip to main content

☑️ Prevent containers from sharing the host’s network namespace

When a container is allowed to share its host's network namespace, it can access local network listeners and leverage it to probe the host's local network.

Targeted resources by this rule (types of kind): Deployment / Pod / DaemonSet / StatefulSet / ReplicaSet / CronJob / Job

Enabled by default? False

Policy as code identifier: CONTAINERS_INCORRECT_HOSTNETWORK_VALUE_TRUE


This rule will fail

If hostNetwork is set to true

spec:
hostNetwork: true

Rule output in the CLI

$ datree test *.yaml

>> File: failExample.yaml
❌ Prevent containers from sharing the host’s network namespace [1 occurrence]
💡 Incorrect value for key `hostNetwork` - running on the host’s network namespace can allow a compromised container to sniff network traffic

How to fix this failure

Set the hostNetwork to false or remove it completely

spec:
hostNetwork: false

Read more