no-host-namespace
disallow sharing one of the host’s namespaces with the container via a “–network=host”, “–pid=host”, “–ipc=host”, “–uts=host”, “–userns=host”, or “–cgroupns=host” entry in “runArgs”
Why
Namespaces are what make a container a container: the process table, network stack, and IPC objects it sees are its own. A “host” value in “runArgs” hands one of them back, and the container stops being isolated in that dimension. With “–pid=host” every process on the machine is visible from inside the container, and a root process there can signal or trace it; with “–network=host” the container reaches every service bound to the host’s loopback interface, including the ones that are only reachable there because they trust anything local. Put the container on a user-defined Docker network, or forward the port you need, instead of joining the host’s namespace.
Bad
{
"image": "mcr.microsoft.com/devcontainers/base:ubuntu",
"runArgs": ["--network=host"]
}
Good
{
"image": "mcr.microsoft.com/devcontainers/base:ubuntu",
"runArgs": ["--network=devnet"]
}
The good example puts the container on a user-defined Docker network, so it can reach other containers on it by name while keeping a network namespace of its own.