---
title: "Host access behind one grant - Deplo"
description: "Everything that lets a container reach outside its sandbox, from a bind mount to privileged mode, kernel capabilities, host namespaces, foreign volumes and foreign networks, sits behind a single grant an admin gives to a person."
url: "https://web-isometric-9487cf1e.deplo.site/features/host-access-behind-one-grant"
image: "https://web-isometric-9487cf1e.deplo.site/api/media/file/host-access-behind-one-grant.webp"
updated: "2026-09-06"
---

# Host access behind one grant

Everything that lets a container reach outside its sandbox, from a bind mount to privileged mode, kernel capabilities, host namespaces, foreign volumes and foreign networks, sits behind a single grant an admin gives to a person.

![Host access behind one grant](https://web-isometric-9487cf1e.deplo.site/api/media/file/host-access-behind-one-grant.webp)

## Why it matters

A Compose file is user-written YAML. Gating only the obvious bind mount leaves a plain member one key away from root on the server. Deplo refuses at save time, names the key that tripped it and says who can grant it.

[Learn more](https://web-isometric-9487cf1e.deplo.site/docs/advanced/host-access-and-privileges#why-one-grant-covers-all-of-it)

```json
{
  "@context": "https://schema.org",
  "@graph": [
    {
      "@type": "Organization",
      "@id": "https://web-isometric-9487cf1e.deplo.site/#organization",
      "name": "Deplo",
      "url": "https://web-isometric-9487cf1e.deplo.site",
      "description": "Ridicolously good alternative to cloud providers.",
      "logo": {
        "@type": "ImageObject",
        "url": "https://web-isometric-9487cf1e.deplo.site/api/media/file/og_logo.png",
        "width": 824,
        "height": 824
      },
      "sameAs": [
        "https://ds.deplo.build",
        "https://x.com/deplocloud",
        "https://www.instagram.com/deplocloud",
        "https://github.com/DeploCloud/deplo"
      ]
    },
    {
      "@type": "WebSite",
      "@id": "https://web-isometric-9487cf1e.deplo.site/#website",
      "name": "Deplo",
      "url": "https://web-isometric-9487cf1e.deplo.site",
      "description": "Ridicolously good alternative to cloud providers.",
      "publisher": {
        "@id": "https://web-isometric-9487cf1e.deplo.site/#organization"
      }
    }
  ]
}
```

```json
{
  "@context": "https://schema.org",
  "@type": "BreadcrumbList",
  "itemListElement": [
    {
      "@type": "ListItem",
      "position": 1,
      "name": "Features",
      "item": "https://web-isometric-9487cf1e.deplo.site/features"
    },
    {
      "@type": "ListItem",
      "position": 2,
      "name": "Host access behind one grant",
      "item": "https://web-isometric-9487cf1e.deplo.site/features/host-access-behind-one-grant"
    }
  ]
}
```