Rootless Docker reduces the daemon’s dependence on root privileges, while host networking changes the network isolation presented by that Docker daemon. These are separate decisions: rootless mode does not make --network host equivalent to bridge isolation.
What does rootless mode change?
Rootless mode runs the Docker daemon and containers as a non-root user, using user namespaces and related mechanisms. It can reduce the impact of some daemon or container operations, but compatibility, storage, networking, and distribution integration still need review.
What does host networking change?
In standard Docker Engine on Linux, host networking removes the usual per-container network namespace boundary: the workload uses the daemon host’s network stack rather than receiving an isolated container interface. A rootless daemon itself runs inside a user namespace and commonly relies on RootlessKit, so the exact meaning of “host” and the resulting reachability must be verified for the installed Docker and RootlessKit versions. Do not copy assumptions from a rootful host-network example into a rootless deployment.
How should a small host evaluate the combination?
Ask four separate questions:
- Which user and daemon privileges does rootless mode remove?
- Which namespace boundaries does host networking remove?
- Which network namespace contains each listener, and which process owns it?
- Which host and provider firewall rules control reachability?
Avoid blanket claims such as “rootless is safe” or “host networking is always insecure.” The useful conclusion depends on the workload, host policy, and recovery design.
For adjacent decisions, see rootless versus rootful Docker and published ports.