Compose service on the host network (ARCH10013)

Key config.compose.host-network · Severity warning · Category security · CWE CWE-250

On the host network every port the service opens is open on the host, compose’s network isolation does not apply, and the container sees the host’s interfaces and traffic.

Incorrect

services:
  api:
    image: example/api:3.2.0
    network_mode: host

Correct

services:
  api:
    image: example/api:3.2.0
    ports:
      - "8080:8080"

Fix

Use a compose network and publish only the ports that must be reachable.