Back to Checks
kubernetes

Pod does not use hostNetwork

core_minimize_hostNetwork_containers
Service: coreSeverity: high
OfficialBuilt-inVerified
Categories:container-securitytrust-boundaries
Resource Type:Pod

Kubernetes Pods configured with hostNetwork: true are identified, meaning they share the node's network namespace and use the host's IP stack, interfaces, and ports.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Using the host network namespace exposes node-local interfaces and traffic to the pod. A compromise can enable packet capture and request spoofing (C/I), access to node services (e.g., kubelet), and port binding conflicts, causing outages (A) and enabling lateral movement across the cluster.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks core_minimize_hostNetwork_containers

Recommendation

Disallow hostNetwork by default. Enforce least privilege with admission policies that block it, allowing narrowly scoped exceptions only for trusted system workloads. Prefer standard pod networking with NetworkPolicies, and isolate node services for defense in depth.

Remediation

Terraform

resource "kubernetes_pod" "<example_resource_name>" {
  metadata {
    name = "<example_resource_name>"
  }
  spec {
    host_network = false # Critical: disables hostNetwork so the Pod passes the check
    container {
      name  = "ct"
      image = "nginx"
    }
  }
}

Other

1Open Kubernetes Dashboard
2For controller-managed workloads (Deployment/DaemonSet/StatefulSet):
3- Go to Workloads > select the workload > Edit
4- In the Pod template, set spec.template.spec.hostNetwork to false or remove the field
5- Save to roll out new Pods
6For standalone Pods:
7- Go to Workloads > Pods > select the Pod > Delete
8- Click Create > upload the Pod YAML without hostNetwork (or with hostNetwork: false) and create the Pod

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.core.core_client import core_client


class core_minimize_hostNetwork_containers(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in core_client.pods.values():
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            if pod.host_network:
                report.status = "FAIL"
                report.status_extended = f"Pod {pod.name} is using hostNetwork."
            else:
                report.status = "PASS"
                report.status_extended = f"Pod {pod.name} is not using hostNetwork."
            findings.append(report)

        return findings

References