Rules / GL058

GL058 docker run --network host in CI script

Severity: warn
OWASP: CICD-SEC-7 – Insecure System Configuration
CWE: CWE-653 – Improper Isolation or Compartmentalization

Risk

docker run --network host removes all network isolation between the container and the runner host. The container shares the host's network stack directly — it can bind to any port, intercept traffic on the host interface, reach services bound to localhost (metadata APIs, internal databases, other containers' exposed ports), and potentially communicate with the broader runner network without any firewall boundary.

In CI this pattern is often used for performance (avoiding NAT overhead) but silently eliminates a meaningful security boundary.

Trigger example

test:
  script:
    - docker run --network host myimage ./integration-test.sh

Both --network host and the --net host short form are detected, space- or =-separated.

Safe alternative

Use a named network or the default bridge:

test:
  script:
    - docker network create test-net
    - docker run --network test-net myimage ./integration-test.sh

Notes

• Severity is warn — sometimes a deliberate performance choice, but it removes a security boundary and should be justified.
• Related: GL056 (--privileged), GL057 (--cap-add).
• Script-line rule; assumes POSIX shell (see the README Shell assumptions note).
• Suppress per-file with .glsec-ignore or inline # glsec:ignore GL058.

Documentation for glsec 1.23.0. Source of this page · Rule implementation