The host kernel is the shared core of the operating system that runs beneath containers on a machine. Containers may have separate filesystems, processes, and network views, but they still rely on the same kernel to manage memory, scheduling, system calls, sockets, and device access. In other words, the host kernel is the boundary every container must cross to use the machine.
This matters because a flaw in the host kernel can affect every container at once. If an attacker reaches a vulnerable kernel path from inside a container, a memory bug such as a use-after-free may lead to crashes, privilege escalation, or container escape. Defenders reduce this risk by patching the kernel quickly, limiting container privileges, and using controls such as seccomp and AppArmor. These measures help, but they do not replace timely host-kernel updates.