Do not specify hostPort unless absolutely necessary

Error: hostPort is specified

Bridgecrew Policy ID: BC_K8S_25
Checkov Check ID: CKV_K8S_26
Severity: LOW

hostPort is specified


The hostPort setting applies to the Kubernetes containers. The container port will be exposed to the external network at :, where the hostIP is the IP address of the Kubernetes node where the container is running, and the hostPort is the port requested by the user.

We recommend that you do not specify a hostPort for a pod unless it is absolutely necessary. When you bind a pod to a hostPort, it limits the number of places the pod can be scheduled, because each <hostIP, hostPort, protocol> combination must be unique.



If you do not specify the hostIP and protocol explicitly, Kubernetes will use as the default hostIP and TCP as the default protocol. This will expose your host to the internet.

Fix - Buildtime


  • Resource: Container
  • Argument: hostPort (Optional)
    Defines the number of port to expose on the host.
apiVersion: v1
kind: Pod
  name: <Pod name>
  - name: <container name>
    image: <image>
-    hostPort: <port>