Will It Vibe?Container uses the host network namespace
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 8 points from that category, once per scan, no matter how many places it turns up.
What it detects
network_mode: host removes network isolation: the container shares the host network stack and every host port, bypassing published-port scoping and per-container firewalling.
Why it matters
network_mode: host removes the network namespace boundary, so the container shares the host IP stack and can bind or reach any host port directly. Published-port mappings and per-container firewall rules no longer apply, and a service meant to be internal can end up listening on a public interface. It also makes port conflicts with the host and other services more likely.
How to fix it
Drop network_mode: host and use Compose networking: put services on a user-defined network and publish only the ports you need with an explicit 127.0.0.1 bind for anything internal. Host networking is only justified for a few tools such as network scanners; for those, keep the service off any public interface.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo