Topic: privilege-escalation

• Access to the Docker socket is root on the host: what mounting it into a container really grants

  Whoever can talk to the Docker daemon can start a container that mounts the host's root file system with full access. Mounting /var/run/docker.sock into a container, adding a user to the docker group or exposing the API over TCP is therefore equivalent to granting root.

  article · en · reviewed · knowledge as of 2026-09-23

Machine-readable: JSON