Docker socket
A Unix domain socket exposed by the Docker daemon (dockerd) through which the Docker CLI communicates with the daemon and issues commands such as creating, starting, stopping and deleting containers. Anyone able to read and write this socket effectively holds root privileges on the host machine.
Timeline (last 90 days)
Anything that can access the Docker socket can do anything on that machine, including launching a container that mounts the entire filesystem to read arbitrary files, which is equivalent to having root privileges on the host.
The read-only mount flag on the Docker socket only makes the socket file itself read-only and places no restriction whatsoever on API requests sent over that connection, including write operations such as restarting containers.
All Facts (2)
Anything that can access the Docker socket can do anything on that machine, including launching a container that mounts the entire filesystem to read arbitrary files, which is equivalent to having root privileges on the host.
50%UnverifiedThe read-only mount flag on the Docker socket only makes the socket file itself read-only and places no restriction whatsoever on API requests sent over that connection, including write operations such as restarting containers.
50%