Lesson 4.43: The Docker socket and host mounts
Whoever can talk to the Docker daemon can start a privileged container that mounts the host's disk, so access to /var/run/docker.sock is root access. Mounting the socket into a container hands that power to the container; bind-mounting / or /etc does something similar without any API at all. In the lab you list every container's bind mounts, find a dashboard holding the socket and a tools container with the whole host file system, remove what isn't needed, narrow what is, and take a contractor out of the docker group.
16 min
You will learn to
- Explain why Docker socket access equals root
- List bind mounts with docker inspect
- Recognise dangerous mounts (socket, /, /etc)
- Replace a broad mount with a narrow read-only one
- Audit the docker group
Key terms
- Docker socket
- /var/run/docker.sock: the Unix socket of the Docker API, served by root's dockerd.
- Bind mount
- A host path made visible inside a container (-v /src:/dst[:ro]).
- docker group
- Members may use the socket without sudo.
- :ro
- Mount option: read-only inside the container.
- Socket proxy
- A filter in front of the Docker API that allows only selected calls.
← Kernel settings that drift: sysctl precedence · All lessons · Phone, SMS and QR phishing →