Why is access to the Docker socket dangerous?
The Docker daemon usually runs as root, and its socket accepts commands to start containers. Anyone who can talk to it can launch a container that mounts the host filesystem, which is effectively root on the host. Never expose the socket to untrusted workloads.
Answered in
What docker run Actually Does: Daemon, containerd, runc, Namespaces, cgroupsA container is a normal Linux process with isolation and limits. Follow one docker run from the CLI through dockerd and containerd to kernel namespaces.
Read the full analysisOther questions this article answers
More developer tooling questions
Every answer on Crashtech is written by the editor of the article it comes from — never auto-summarised. Browse all answers or the Developer Tooling beat.