fix(networking): treat host-network services as host-exposed in summaries (#1430)

The exposure summaries derived a stack's exposure solely from the declared
published-port list, so a service running with network_mode: host (which
publishes every container port on the host but declares no ports:) was
under-reported as less exposed than it actually is.

Capture network_mode in the lightweight dependency parser, add an
isHostNetwork predicate, and treat a host-network service as exposed and
publishing across the Fleet networking summary, the Stack Dossier export, and
the Networking panel, matching how the Compose Doctor already flags host
networking.

backend/src/__tests__/compose-dependency-parse.test.ts

@@ -66,6 +66,15 @@ describe('parseComposeDependencies - ports', () => {
   });
 });
 
+describe('parseComposeDependencies - network_mode', () => {
+  it('captures network_mode and leaves it undefined when absent', () => {
+    const host = parseComposeDependencies(svc('web', 'image: nginx\nnetwork_mode: host'));
+    expect(host.services[0].networkMode).toBe('host');
+    const none = parseComposeDependencies(svc('web', 'image: nginx'));
+    expect(none.services[0].networkMode).toBeUndefined();
+  });
+});
+
 describe('parseComposeDependencies - top-level resources', () => {
   it('normalizes external (bool), legacy external object, and name: override', () => {
     const r = parseComposeDependencies('services:\n  web:\n    image: nginx\nnetworks:\n  a:\n  b:\n    external: true\n  c:\n    external:\n      name: legacy_net\n  d:\n    name: custom_net\nvolumes:\n  v:\n    external: true\n');

backend/src/__tests__/networking-summary.test.ts

@@ -105,6 +105,47 @@ describe('networking summary', () => {
     expect(res.body.unknownExposure.stacks).toContain(STACK);
   });
 
+  it('marks a host-network stack exposed and unknown-exposure even with no published ports', async () => {
+    fs.writeFileSync(path.join(stackDir, 'compose.yaml'), 'services:\n  app:\n    image: nginx:latest\n    network_mode: host\n');
+    const res = await request(app).get('/api/networking/summary').set('Authorization', authHeader);
+    expect(res.status).toBe(200);
+    expect(res.body.exposed.stacks).toContain(STACK);
+    expect(res.body.unknownExposure.stacks).toContain(STACK);
+  });
+
+  it('drops a host-network stack from unknown-exposure once an intent is set', async () => {
+    fs.writeFileSync(path.join(stackDir, 'compose.yaml'), 'services:\n  app:\n    image: nginx:latest\n    network_mode: host\n');
+    DatabaseService.getInstance().setStackExposureIntent(1, STACK, '', 'lan', 'admin');
+    const res = await request(app).get('/api/networking/summary').set('Authorization', authHeader);
+    expect(res.body.exposed.stacks).toContain(STACK);
+    expect(res.body.unknownExposure.stacks).not.toContain(STACK);
+  });
+
+  it('keeps a stack unknown when an unclassified host-network service sits beside a classified ports service', async () => {
+    fs.writeFileSync(path.join(stackDir, 'compose.yaml'),
+      'services:\n  metrics:\n    image: nginx:latest\n    network_mode: host\n  web:\n    image: nginx:latest\n    ports:\n      - "8080:80"\n');
+    // web classified, the host-network metrics service still unset, so the stack stays unknown.
+    DatabaseService.getInstance().setStackExposureIntent(1, STACK, 'web', 'public', 'admin');
+    const res = await request(app).get('/api/networking/summary').set('Authorization', authHeader);
+    expect(res.body.exposed.stacks).toContain(STACK);
+    expect(res.body.unknownExposure.stacks).toContain(STACK);
+  });
+
+  it('does not treat a non-host network_mode (none) as exposed', async () => {
+    fs.writeFileSync(path.join(stackDir, 'compose.yaml'), 'services:\n  app:\n    image: nginx:latest\n    network_mode: none\n');
+    const res = await request(app).get('/api/networking/summary').set('Authorization', authHeader);
+    expect(res.body.exposed.stacks).not.toContain(STACK);
+    expect(res.body.unknownExposure.stacks).not.toContain(STACK);
+  });
+
+  it('the fleet aggregate counts a host-network stack as exposed', async () => {
+    fs.writeFileSync(path.join(stackDir, 'compose.yaml'), 'services:\n  app:\n    image: nginx:latest\n    network_mode: host\n');
+    const res = await request(app).get('/api/fleet/networking-summary').set('Authorization', authHeader);
+    expect(res.status).toBe(200);
+    const local = res.body.nodes.find((n: { summary: { exposed: { stacks: string[] } } | null }) => n.summary?.exposed.stacks.includes(STACK));
+    expect(local).toBeDefined();
+  });
+
   it('the fleet aggregate returns a per-node summary for the hub', async () => {
     const res = await request(app).get('/api/fleet/networking-summary').set('Authorization', authHeader);
     expect(res.status).toBe(200);

backend/src/helpers/composeDependencyParse.ts

@@ -24,6 +24,8 @@ export interface DeclaredService {
   ports: DeclaredPort[];
   /** Service `image:` reference as declared, or undefined for build-only services. */
   image?: string;
+  /** Service `network_mode:` as declared (e.g. `host`), or undefined. */
+  networkMode?: string;
 }
 
 /** A top-level networks:/volumes: entry. */
@@ -194,6 +196,7 @@ export function parseComposeDependencies(content: string): DeclaredCompose {
       volumes,
       ports,
       image: asString(svc.image),
+      networkMode: asString(svc.network_mode),
     });
   }
 

backend/src/services/network/networkingSummary.ts

@@ -10,7 +10,7 @@ import { FileSystemService } from '../FileSystemService';
 import { DatabaseService } from '../DatabaseService';
 import { parseComposeDependencies } from '../../helpers/composeDependencyParse';
 import { assembleStackDrift } from '../DriftDetectionService';
-import { isLoopback } from './normalize';
+import { isHostNetwork, isLoopback } from './normalize';
 import { getErrorMessage } from '../../utils/errors';
 import { sanitizeForLog } from '../../utils/safeLog';
 
@@ -60,8 +60,13 @@ export async function computeNodeNetworkingSummary(nodeId: number): Promise<Node
     const declared = parseComposeDependencies(content);
     if (declared.parseError) continue;
 
-    const publishesPort = declared.services.some(s => s.ports.length > 0);
-    if (declared.services.some(s => s.ports.some(p => !isLoopback(p.hostIp)))) exposed.push(stack);
+    // A host-network service publishes every container port directly on the host,
+    // so it counts as exposed (beyond loopback) and as publishing even with no
+    // declared `ports:`. This keeps the summary honest about host networking,
+    // matching the Compose Doctor's host-network finding.
+    const publishes = (s: typeof declared.services[number]): boolean => s.ports.length > 0 || isHostNetwork(s.networkMode);
+    const publishesPort = declared.services.some(publishes);
+    if (declared.services.some(s => isHostNetwork(s.networkMode) || s.ports.some(p => !isLoopback(p.hostIp)))) exposed.push(stack);
 
     if (publishesPort) {
       // Unknown only when a publishing service is effectively unclassified: a
@@ -70,7 +75,7 @@ export async function computeNodeNetworkingSummary(nodeId: number): Promise<Node
       const stackIntent = intents.find(i => i.service === '')?.intent ?? null;
       const byService = new Map(intents.filter(i => i.service !== '').map(i => [i.service, i.intent]));
       const anyUnclassified = declared.services
-        .filter(s => s.ports.length > 0)
+        .filter(publishes)
         .some(s => {
           const intent = byService.get(s.name) ?? stackIntent;
           return intent === null || intent === 'unknown';

backend/src/services/network/normalize.ts

@@ -23,6 +23,13 @@ export function isLoopback(ip: string): boolean {
   return ip === '127.0.0.1' || ip === '::1' || ip === '[::1]';
 }
 
+/** True for `network_mode: host`, which publishes every container port directly
+ *  on the host regardless of any declared `ports:` (so it is always exposed
+ *  beyond loopback). Other modes (none, bridge, service:, container:) are not. */
+export function isHostNetwork(mode: string | undefined): boolean {
+  return mode === 'host';
+}
+
 /** Resolved runtime name of a top-level network/volume: a `name:` override wins,
  *  otherwise compose prefixes the project (`<project>_<key>`). An external
  *  resource is never project-prefixed: it references a pre-existing network/volume