Host networking removes network isolation. The container shares the host's network namespace, gets no IP address of its own, and can reach services the host exposes locally. Use it only for trusted workloads that truly need it, and use the none driver when code should have no network at all.
What host mode does
Docker's documentation says that with host networking, the container's network stack is not isolated from the Docker host. If a container binds to port 80, the application is available on port 80 of the host's IP address. Because no separate address exists, port publishing flags are ignored and Docker prints a warning that published ports are discarded.
The documented reasons to use it are performance and handling a large range of ports, since it avoids network address translation and the per port proxy.
The security consequence
Docker's own example shows both directions. A server in a container becomes reachable from the host, and a container started with host networking can reach servers running on the host. The documentation says this works in both directions, over TCP and UDP.
So a process in a host network container can try to connect to anything bound to localhost on the machine: a database that was never meant to be exposed, a local admin interface or a development server. Services that relied on localhost as their only protection lose it.
Three modes compared
| Mode | What the container sees | Typical use |
|---|---|---|
| host | The host's network stack, no separate IP | Performance, many ports |
| none | Only a loopback device, no external connectivity | Running code with no network |
| default bridge style networking | Its own network stack, with ports published only when you ask | Normal services |
For the none driver, Docker's example shows that only the loopback interface exists inside the container, and that no IPv6 loopback address is configured. For container ports in default networking, Docker states that by default none of a container's ports are exposed to the host until you publish them.
Platform notes
Docker documents host networking for Docker Engine on Linux, and for Docker Desktop version 4.34 and later when you enable it in settings. Docker Desktop has its own section on the page, so check how host networking maps in your setup before relying on it.
A decision routine
- Does the workload need host networking, or only a few published ports? Prefer publishing ports.
- Does it handle untrusted input or run code you did not write? Do not use host mode.
- Does anything sensitive listen on localhost on that machine? If yes, host mode exposes it.
- Does the job need no network at all? Use the none driver.
- Record any exception with an owner, as with the other weakening settings in the run settings audit.
For a command that combines none with other limits, see the throwaway container checklist.
Safeguard does not configure container networking. It scans dependencies and images, with a free scan at gold.safeguard.sh/scan.
Quick check
Does host mode work with published port flags?
No. Docker says published ports are discarded in host network mode, and the container's ports are simply the host's ports.
How do I give a container no network access?
Start it with the none network driver. Only a loopback device exists inside, so nothing external is reachable.
Sources
Last reviewed: 19 October 2026.
