Dangerous
docker run -v /var/run/docker.sock:/var/run/docker.sock -it alpinecross-platform · bash · Advanced
Mounts the Docker control socket inside a container. Anything that can talk to that socket can start a new privileged container mounting the host filesystem, so this hands over root on the host without ever using the word privileged.
Signals to notice
- Docker socket exposed inside a container
- Equivalent to root on the host
- No privileged flag to give it away
Think you can spot these under time pressure?
Start TrainingMore Containers
docker run --privileged -v /:/host -it alpineAdvanceddocker exec -it web shExpertdocker run -d --restart=always -v /:/mnt alpine sh -c 'sleep infinity'Expertdocker run --rm -v "$PWD":/work:ro -w /work node:20-alpine npm run lintNightmaredocker exec app-1 cat /app/logs/startup.logIntermediatesudo docker run --privileged -v /:/host node:20 node /host/srv/app/fix.jsAdvanced