Reads one file from inside a running container. docker exec can run anything, which is why it reads as dangerous, but what it is asked to run here is cat against a version file.