network_mode: host makes the container share the host's network stack. It can reach services the host binds to 127.0.0.1, listen on any host interface, and its own ports are exposed without any ports: entry. The explainer marks it high. A user-defined network plus explicit ports keeps the service reachable while keeping the isolation.
openrouting — compose explainer
$ explain docker-compose.yml! app uses the host network highline 4fix: see below$
What the free Docker Compose explainer reports on the risky example below.
Why it matters
With host networking the container has no network namespace of its own. Anything listening on the host's loopback interface, such as an admin console or a database bound to localhost, is reachable from inside it.
Every port the service opens is open on the host's interfaces directly. Compose's `ports` mapping does not apply in this mode, so there is no single place in the file that shows what is exposed.
It is often used to avoid port mapping or to reach a service on the host, both of which have narrower options.
Attach the service to a user-defined network shared only with the services it talks to.
Publish just the ports that must be reachable from outside with ports, bound to 127.0.0.1 if only the host needs them.
To reach a service on the host from the container, use the host's address on the Docker bridge (or host.docker.internal where available) instead of sharing the whole network stack.
When it's acceptable
Network tools that genuinely need the host's interfaces, such as some VPN, DHCP or packet-capture services, on hosts where that is expected.
Performance-sensitive services where you have measured the overhead of the bridge and accepted the loss of isolation.
Check your own docker-compose.yml
The risky example is loaded below. Paste your own file to check it for this and every other Docker Compose rule. It runs in your browser; nothing is uploaded.
Limits memory to 512m. The container is killed if it exceeds this.
Questions
What does network_mode: host do in docker-compose?
The container uses the host's network namespace: same interfaces, same IP addresses, same localhost. Port mappings are ignored because the service listens on the host directly.
Can a container with host networking reach localhost services on the host?
Yes. Its 127.0.0.1 is the host's 127.0.0.1, so any service bound only to loopback on the host is reachable from inside it.
Why are my ports ignored with network_mode: host?
There is no separate container network to map from, so Docker discards published ports in host mode. The service is reachable on whatever port it listens on.