Check ID: core_minimize_hostNetwork_containers
Provider: Kubernetes
Service: core
Severity: HIGH
Categories: container-security, trust-boundaries
Resource type: Pod

​
What this check verifies

Kubernetes Pods configured with hostNetwork: true are identified, meaning they share the node’s network namespace and use the host’s IP stack, interfaces, and ports.

​
Risk

Using the host network namespace exposes node-local interfaces and traffic to the pod. A compromise can enable packet capture and request spoofing (C/I), access to node services (e.g., kubelet), and port binding conflicts, causing outages (A) and enabling lateral movement across the cluster.

​
Recommendation

Disallow hostNetwork by default. Enforce least privilege with admission policies that block it, allowing narrowly scoped exceptions only for trusted system workloads. Prefer standard pod networking with NetworkPolicies, and isolate node services for defense in depth.

​
Remediation

resource "kubernetes_pod" "<example_resource_name>" {
  metadata {
    name = "<example_resource_name>"
  }
  spec {
    host_network = false # Critical: disables hostNetwork so the Pod passes the check
    container {
      name  = "ct"
      image = "nginx"
    }
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = core_minimize_hostNetwork_containers. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Kubernetes checks