diff --git a/php/src/Docker/DockerActionManager.php b/php/src/Docker/DockerActionManager.php
index f528c389..bca4207e 100644
--- a/php/src/Docker/DockerActionManager.php
+++ b/php/src/Docker/DockerActionManager.php
@@ -381,6 +381,9 @@ readonly class DockerActionManager {
         $capDrops = $container->capDrop;
         if (count($capDrops) > 0) {
             $requestBody['HostConfig']['CapDrop'] = $capDrops;
+        } else if (!in_array('NET_RAW', $capAdds, true)) {
+            // Prevent ARP spoofing by default
+            $requestBody['HostConfig']['CapDrop'] = ['NET_RAW'];
         }
 
         // Disable SELinux for AIO containers so that it does not break them