diff --git a/kernel/util/path.go b/kernel/util/path.go
index 2b5a81957..6fae2db3a 100644
--- a/kernel/util/path.go
+++ b/kernel/util/path.go
@@ -416,6 +416,7 @@ func IsSensitivePath(p string) bool {
 		"passwd":          {},
 		"shadow":          {},
 		"pgpass":          {},
+		"hosts":           {},
 		"credentials":     {}, // 如 aws credentials
 		"config.json":     {}, // docker config.json 可能含 token
 	}