Docker socket is mounted in a container

Description

Mounting /var/run/docker.sock lets processes with socket access communicate directly with the host Docker daemon. With a typical rootful daemon, creating containers or mounting host paths can provide control over the host.

Even for build automation or administration, restrict this access to trusted workloads. A read-only socket mount does not make Docker API operations read-only.

Potential impact

Docker API access can allow access to other containers or host files.
An application compromise can extend to the privileges held by the daemon.

Remediation

Remove /var/run/docker.sock mounts from ordinary application containers.
Separate build and management work into isolated environments and restrict daemon access to trusted identities.
Verify required tasks after removing the socket and review other paths to the Docker API.

Examples

The image name is a placeholder. Supply the actual application image and publish only required ports.

Before

yaml

version: "3.1"

services:
  service1:
    container_name: service
    image: notareal/image:latest
    restart: always
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    ports:
      - 8080:8080

Processes that can access the socket can call the host Docker API.

After