hostPath

You are deploying a log collection agent as a DaemonSet. Its job is to read log files that other Pods write to the node’s filesystem under /var/log/pods. An emptyDir volume cannot help here: it starts empty and is private to the Pod. You need to reach into the node’s own filesystem and read what is already there. This is the exact problem hostPath was designed for.

What hostPath does

A hostPath volume mounts a path from the node’s filesystem directly into the container. Unlike emptyDir, the directory already exists on the node before the Pod starts. The container sees it as if it were part of its own filesystem, but reads and writes go straight to the node’s disk.

Think of it like mounting a network drive. The drive exists independently of the machine you plug it into. The container accesses the node’s directory through the mount point, but the data lives on the node.

Building the manifest

Start with the volume declaration, which requires a path (the node-side location) and optionally a type:

# illustrative only
spec:
  volumes:
    - name: node-logs
      hostPath:
        path: /var/log/pods
        type: Directory

Then mount it into the container:

nano log-collector.yaml

apiVersion: v1
kind: Pod
metadata:
  name: log-collector
spec:
  volumes:
    - name: node-logs
      hostPath:
        path: /var/log/pods
        type: Directory
  containers:
    - name: collector
      image: busybox
      command: ['sh', '-c', 'ls /host-logs && sleep 3600']
      volumeMounts:
        - name: node-logs
          mountPath: /host-logs

Apply and inspect the mount:

kubectl apply -f log-collector.yaml

kubectl describe pod log-collector

Look at the Volumes: section. You will see the hostPath entry with the Path and Type fields. The Mounts: line inside the container block confirms /host-logs.

The type field

The type field tells Kubernetes what to check before mounting. This is a pre-flight validation, not storage provisioning.

Directory requires the path to exist and be a directory. File requires it to exist and be a regular file. DirectoryOrCreate creates the directory if it does not exist. FileOrCreate creates the file if it does not exist. Socket requires a Unix socket at that path, which is used for tools that communicate through sockets like the Docker daemon. CharDevice and BlockDevice are for device files used in specialized hardware access scenarios.

If the type check fails, the Pod fails to start with a clear error message in kubectl describe pod.

When hostPath is legitimate

The valid use cases for hostPath are narrow. Log collection agents (like Fluentd or Fluent Bit) running as DaemonSets mount /var/log or /var/log/pods to read logs written by the container runtime. Security monitoring tools like Falco mount /var/run/docker.sock or the containerd socket to observe system calls. Node monitoring agents may mount /proc or /sys to read kernel metrics.

What these cases share: they are system-level agents that need privileged access to node internals, and they are deployed by cluster administrators, not by application developers.

Security warning

hostPath is one of the most dangerous volume types in Kubernetes.

Why does Kubernetes allow this at all? Because Kubernetes is designed to run the full spectrum of workloads, including privileged node-level agents that genuinely need this access. The responsibility for deciding whether a workload should have this privilege falls on the cluster administrator, not the scheduler.

hostPath is a powerful tool for a narrow set of system-level use cases. If you reach for it for an application workload, that is almost always a design problem worth revisiting.