vetkit.compose.container.host-network
A Compose service uses the host network stack (network_mode: host). Every port it opens is exposed directly on the host interfaces and it can reach services bound to the host's loopback address.
Last updated:
Suite: Security
yaml
A Compose service uses the host network stack (network_mode: host). Every port it opens is exposed directly on the host interfaces and it can reach services bound to the host's loopback address.
Category: SECURITY · Engine rule severity: INFO
How to fix it
Use the default bridge network and publish only the required ports, bound to 127.0.0.1 when the service does not need to be reachable from other machines.
References
Source: packages/engine/rules/sast/config.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.