When would you run a container on the host's own network view instead of publishing a mapped port?

## What "the host's own network view" means Ordinarily a container is given its own private view of the network: its own address, its own set of port claims, its own loopback. Publishing bridges that view to the machine with a mapping. The alternative is to skip the private view altogether and let the workload use the **machine's** network stack directly. There is then no container address, no mapping, and nothing to translate — the process binds `8080` on the host exactly as a process installed on the host would. That single change flips several properties at once, and a good answer names both directions. | | published mapping | the host's own network view | |---|---|---| | the container's address | private, its own | none; it uses the machine's | | how traffic arrives | translated at a claimed host port | directly, no rewrite | | the client's source address | commonly rewritten before the process sees it | arrives intact | | port collisions | only between host-side claims | with everything on the machine | | ports the workload can bind | the ones it was given a mapping for | any free port on the host | | other isolation | unchanged | unchanged | ## What you gain - **The real client address.** No source rewrite happens, so anything keyed on the caller's address — rate limits, allowlists, audit records — works without any value having to be conveyed along the path. - **No translation cost.** Every connection skips a rewrite and, in implementations that relay through a process on the host, skips an entire extra hop with its own buffers. At ordinary request rates this is invisible; at very high packet rates it is measurable, and that is the honest reason to reach for it. - **Ports the platform never mapped.** A workload that opens ports dynamically, or that must listen on protocols the mapping was not set up for, simply works. - **Visibility of the machine's own interfaces**, which is what a host-level agent — one that observes or manages the machine itself — actually needs to do its job. ## What you give up - **The port space becomes shared.** Every port the workload binds is a claim on the machine, competing with every other workload and every host process. Two copies of the same workload cannot run on one machine at all, and the number that was an internal detail is now a fleet-wide allocation decision. - **Local-only listeners stop being local.** A workload that binds the loopback address expecting only itself to reach it is now binding the machine's loopback, which every other workload sharing that view can reach. An administrative endpoint someone believed was private is the classic casualty. - **The workload can reach the machine's own services.** Anything listening locally on the host — an agent, a management endpoint — is now within reach, which widens what a compromised workload can touch. - **Placement gets constrained**, for exactly the reason a fixed published port does, but across every port the workload uses rather than one. What you do **not** give up is everything else. The filesystem view, the process view, user-id mapping and the resource ceilings the platform enforces are all untouched. "Host networking means no isolation" is an over-correction, and the opposite error — treating it as merely a faster mapping — is the more common one. ## When it is the right call 1. **A host-level agent.** Something whose job is the machine: observing its interfaces, its traffic, its local endpoints. Giving it a private view would hide the very thing it exists to see. 2. **A latency- or packet-rate-critical path** where the translation hop has been measured and actually matters. Measured, not assumed — for most services it is noise against everything else in the path. 3. **A workload that must see real client addresses** and sits somewhere no layer in front can convey them. 4. **Port ranges too large or too dynamic to map**, where enumerating mappings is impractical. Outside those, the mapping is the better default, because the boundary it keeps is worth more than the hop it costs. The decision is also worth making once, for the estate, rather than per team: every workload that takes the host's network view removes a little more of the machine's port space from anybody else's reach, and the person who discovers the conflict is rarely the person who made the choice.