hostPath — mounting the node filesystem into a Pod

hostPath mounts a file or directory from the node’s filesystem into a Pod. It is the most powerful and most dangerous volume type in Kubernetes: it breaks Pod portability, leaks node-level data into Pods, and is a common security incident vector. This lesson walks the legitimate uses, the anti-patterns, and the alternatives.

How hostPath works

A hostPath volume mounts a path from the node’s filesystem into a Pod:

apiVersion: v1
kind: Pod
metadata:
  name: log-reader
spec:
  containers:
  - name: app
    image: app:v1
    volumeMounts:
    - name: logs
      mountPath: /host-var-log
      readOnly: true
  volumes:
  - name: logs
    hostPath:
      path: /var/log
      type: Directory

The Pod sees the node’s /var/log directory at /host-var-log. Files written to the node’s /var/log appear in the Pod (and vice versa, if not readOnly).

The type field

The type field specifies what kind of hostPath the volume points to:

The type field is a safety net: DirectoryOrCreate and FileOrCreate create the path if missing, which can mask misconfigurations. The stricter types (Directory, File) fail the Pod if the path does not exist.

Legitimate use cases

hostPath is appropriate for a narrow set of use cases:

• System services: DaemonSets that need access to the node’s system paths (kubelet, container runtime, logging agent, monitoring agent).
• Node-level tooling: tools that read node state (e.g., node-problem-detector reading kernel logs).
• Container runtime sockets: the kubelet needs access to /var/run/docker.sock or /run/containerd/containerd.sock.
• Pre-populated configuration: a configuration file placed on the node by a bootstrap script.

# Legitimate: monitoring agent reading node logs
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: node-logger
spec:
  template:
    spec:
      containers:
      - name: logger
        image: logger:v1
        volumeMounts:
        - name: logs
          mountPath: /host-log
          readOnly: true
      volumes:
      - name: logs
        hostPath:
          path: /var/log
          type: Directory

The DaemonSet pattern is the standard legitimate use: one Pod per node, accessing node-level state.

Security implications

hostPath is a security risk because:

• Node escape: a Pod with a hostPath mount to / or /etc can read or modify node-level configuration. A privileged Pod with / mounted can effectively own the node.
• Data leakage: a Pod with a hostPath mount can read sensitive data on the node (other Pods’ data, kubelet credentials, cloud-provider credentials).
• Cross-Pod data exposure: a Pod with a hostPath mount to /var/lib/kubelet/pods/<other-pod-uid>/ can read another Pod’s volumes.
• Pod Security Standards: the restricted profile disallows hostPath; the baseline profile allows it with restrictions; the privileged profile allows it freely.

Anti-patterns

hostPath is not appropriate for:

• Database data: use PVC. hostPath data is lost on node failure.
• Application logs: use a logging agent (Fluentd, Vector) with a DaemonSet, not hostPath. The agent reads the container’s stdout, not the node’s filesystem.
• Uploaded files: use PVC or object storage.
• Anything that must survive Pod reschedule: hostPath is tied to the node.

Alternatives

• For node-level data: use a DaemonSet with a hostPath; this is the legitimate pattern.
• For Pod-level data: use emptyDir (ephemeral) or PVC (persistent).
• For shared data: use a network filesystem (NFS, CephFS) with PVC.
• For configuration: use ConfigMaps (mounted as volumes) and Secrets.

Quiz

Production discipline

• hostPath is for DaemonSets, not for application Pods. The legitimate use is node-level access, not application data.
• Never mount hostPath /. A privileged Pod with / mounted is a node compromise.
• Apply Pod Security Standards. The restricted profile forbids hostPath; the baseline profile allows it with restrictions; the privileged profile allows freely.
• Use PVC for stateful data. Even if the cluster doesn’t have a CSI driver, deploy one before migrating stateful workloads.
• Document hostPath usage in the cluster bootstrap. Every hostPath is a security and portability trade-off; the trade-off must be auditable.