DevOps• 5 MIN READ
Kirito

Kirito

6/10/2026•5 min read

The Docker Network That Leaked Host Ports (And Exposed Redis to the Internet)

Using 'network_mode: host' on a Redis container seemed convenient – until we realized it exposed Redis directly to the public internet without authentication.

The Docker Network That Leaked Host Ports (And Exposed Redis to the Internet)

"Your Redis instance is public and has no password."

That was a message from our security team at 2 AM. Someone had scanned our IP and found an open Redis port – 6379 – accessible from anywhere.

The Setup

We ran Redis in a Docker container for caching. For performance reasons, we used host networking:

# docker-compose.yml
services:
  redis:
    image: redis:7
    network_mode: host
    # No port mapping because host mode bypasses Docker's network

The Problem

network_mode: host makes the container use the host's network stack directly. The Redis port (6379) binds to all interfaces (0.0.0.0) by default.

With host networking, there is no Docker firewall protecting the port. It's as if Redis is installed directly on the host.

Our cloud firewall (AWS Security Group) was configured to allow port 6379 only from our VPC – but we had accidentally left a rule open to 0.0.0.0/0 during testing.

Result: Redis was publicly accessible. No password. Anyone could flushall, read cache data (including session tokens), and potentially execute Lua scripts.

The Fix

  1. Remove host network mode – use bridge network with port mapping.
  2. Add a Redis password (even if network is internal).
  3. Bind Redis to localhost only (if using host mode, set 'bind 127.0.0.1').

New config:

services:
  redis:
    image: redis:7
    command: redis-server --requirepass $ {REDIS_PASSWORD} --bind 0.0.0.0
    ports:
      - "127.0.0.1:6379:6379"  # bind only to localhost
    networks:
      - internal

What I Learned

  • Host networking bypasses all Docker security isolation – only use if absolutely necessary.
  • Never run Redis without a password in any environment.
  • Port binding to 127.0.0.1 prevents external access even if firewall rules slip.
  • Regular security scans (e.g., 'nmap -p 6379 your-ip') would have caught this.

That exposed Redis taught us to treat every container as potentially public. Now we have a default 'redis.conf' with 'requirepass' and 'bind 127.0.0.1'.