A host filesystem mount is a directory or path from the operating system running a VM or container that is exposed inside the guest environment. It lets software in the isolated environment read, and sometimes write, files that still physically belong to the host.
This matters because a mount can weaken the boundary between a sandbox and the real machine. If the mount is too broad or read-write, untrusted code may steal documents, credentials, source code, or configuration files, or it may modify host data to plant persistence or alter behavior. In attacks, mounts are often the bridge that turns a limited container compromise into host-level impact. In defenses, teams reduce risk by minimizing mounted paths, preferring read-only access, keeping secrets outside shared folders, and reviewing exactly which host resources are exposed to guest workloads.