Docker and CI/CD · Middle · Question 28 of 75

Why is mounting `/var/run/docker.sock` into a container risky?

1It exposes the container's logs to the public internet
✓Correct answer: It effectively gives that container root on the host
3It makes the Docker daemon run noticeably slower

Explanation

Whoever controls the Docker API can start a privileged container that mounts the host filesystem. Only trusted tools should get the socket.

Further reading

Docker Docs: Docker Engine security ↗

Test yourself

Take the Docker and CI/CD · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.