These three pod fields make the pod share the node's namespaces instead of getting its own. hostNetwork uses the node's network namespace, hostPID uses its process ID namespace, and hostIPC uses its IPC namespace. The Baseline Pod Security Standard says sharing host namespaces must be disallowed.
What each field does
The Kubernetes API reference describes them:
| Field | Meaning in the API reference | Default |
|---|---|---|
| hostNetwork | Use the host's network namespace | false |
| hostPID | Use the host's PID namespace | false |
| hostIPC | Use the host's IPC namespace | false |
The reference adds that when hostNetwork is true, specified hostPort values must match containerPort.
Why they matter for security
Sharing a namespace removes a layer of isolation. Without describing every attack, the practical consequences follow from what the namespace is:
- Network. With hostNetwork the pod uses the node's network namespace, so it can reach services bound to the node's own interfaces. Check your network plugin's documentation for how network policy treats host networked pods.
- PID. With hostPID the pod can see processes on the node, not just its own.
- IPC. With hostIPC the pod shares the node's inter process communication resources.
Each one weakens the boundary the container runtime normally provides, which is why the standard treats them as a Baseline violation.
What the standard says
Under the Baseline policy, host namespaces must be disallowed. The restricted fields are spec.hostNetwork, spec.hostPID and spec.hostIPC. The allowed values are undefined, nil or false. Baseline also forbids privileged containers and hostPath volumes, and it restricts host ports.
Who legitimately needs them
Some node level components do, such as certain networking or monitoring agents. Treat each as an exception:
- Name the workload and owner.
- Put it in its own namespace.
- Allow the exception for that namespace only, not cluster wide.
- Review it when the workload is upgraded.
How to find them today
Search manifests and live objects for the three field names set to true. In YAML, a search for hostNetwork: true is a start. A policy check on rendered manifests is better, since Helm charts and Kustomize overlays may set them indirectly.
kubectl get pods -A -o json | jq -r '.items[] | select(.spec.hostNetwork==true or .spec.hostPID==true or .spec.hostIPC==true) | .metadata.namespace + "/" + .metadata.name'
Quick check
Does hostNetwork give a pod its own IP?
No. The API reference says it uses the host's network namespace, so the pod shares the node's network identity.
Are these fields blocked by default?
Only if you enforce the Baseline or Restricted standard, or an equivalent policy, on the namespace.
Safeguard runs policies and gates on pull requests, so a failed rule can hold a merge, and its dependency and SBOM scanning covers the packages your infrastructure code pulls in. You can try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
