Ensure Host Network Namespace Is Not Shared (CIS 5.10)

Impact & Risk Analysis

Severity: High
CIS Benchmark: CIS 5.10
Impact: Host Compromise & Service Denial. When a container shares the host’s network namespace, it lives “outside” the container isolation. It can open reserved low-numbered ports, access critical network services like D-Bus on the host, and even potentially shut down the Docker host or spoof network traffic.

Common Misconfiguration

Setting the networking mode to host (--net=host). This instructs Docker not to containerize the networking, effectively giving the container full access to the host’s network interfaces.

Vulnerable Example

# Vulnerable docker-compose.yml
version: '3.8'
services:
  web:
    image: nginx:latest
    # VULNERABLE: Container shares the host network stack
    network_mode: host

# Vulnerable Docker Run Command
# The --net=host flag disables network isolation
docker run -d --net=host nginx:latest

Secure Example

# Secure docker-compose.yml
version: '3.8'
services:
  web:
    image: nginx:latest
    # SECURE: Use the default bridge or a user-defined network
    ports:
      - "80:80"
    networks:
      - web-net

networks:
  web-net:

# Secure Docker Run Command
# Defaults to bridge mode (secure)
docker run -d -p 80:80 nginx:latest

Audit Procedure

Run the command below to inspect the network mode of all containers:

docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: NetworkMode={{ .HostConfig.NetworkMode }}'

Result: Check the NetworkMode value for each container.
Fail: If it returns NetworkMode=host.
Pass: If it returns default, bridge, or the name of a custom network.

Remediation

You should not pass the --net=host option when starting any container unless there is a very specific, unavoidable reason. By default, containers connect to the Docker bridge and do not run in the context of the host’s network stack.

Getting Started

Product Guides

Integrations

Supported Languages

Vulnerability Reference

Security & Trust

User Management

Ensure Host Network Namespace Is Not Shared (CIS 5.10)

Impact & Risk Analysis

Common Misconfiguration

Vulnerable Example

Secure Example

Audit Procedure

Remediation

​Impact & Risk Analysis

​Common Misconfiguration

​Vulnerable Example

​Secure Example

​Audit Procedure

​Remediation

Impact & Risk Analysis

Common Misconfiguration

Vulnerable Example

Secure Example

Audit Procedure

Remediation