The Docker Socket Is Powerful
Access to the Docker daemon socket can effectively grant control over the host's containers and can often be escalated to host-level control. Do not mount /var/run/docker.sock into containers unless the workload genuinely requires daemon access.
When daemon access is necessary, consider safer architectures such as a narrowly scoped remote API or dedicated build service.
ADVERTISEMENT