Container engine socket mounted

This product is not supported for your selected Datadog site. ().

Metadata

Id: dockercompose-docker-socket-mounted-in-container

Platform: DockerCompose

Severity: High

Category: Access Control

Learn More

Description

Mounting a Docker or Podman engine socket into a service grants that container control over the host’s container daemon. This can allow it to create privileged containers, modify running workloads, and access other container filesystems, effectively bypassing isolation boundaries. Services should not mount engine sockets directly or through named volumes backed by host bind mounts.

Compliant Code Examples

services:
  lookalike:
    image: alpine
    volumes: ['/var/run/docker.sock.bak:/var/run/docker.sock']
  target_only:
    image: alpine
    volumes:
      - type: volume
        source: cache
        target: /var/run/docker.sock
  anonymous:
    image: alpine
    volumes: ['/var/run/docker.sock']
  npipe_not_engine:
    image: alpine
    volumes:
      - type: npipe
        source: '\\.\pipe\sql\query'
        target: '\\.\pipe\sql\query'
  no_api_socket:
    image: alpine
    use_api_socket: false
volumes:
  cache: {}

Non-Compliant Code Examples

services:
  docker:
    image: alpine
    volumes: ['/var/run/docker.sock:/var/run/docker.sock:ro']
  rootless_podman:
    image: alpine
    volumes:
      - type: bind
        source: /run/user/1000/podman/podman.sock
        target: /run/podman/podman.sock
  windows:
    image: alpine
    volumes: ['\\.\pipe\docker_engine:/docker-engine']
  windows_forward_slashes:
    image: alpine
    volumes: ['//./pipe/docker_engine:/docker-engine']
  named_bind:
    image: alpine
    volumes:
      - engine_socket:/var/run/docker.sock
  named_rbind:
    image: alpine
    volumes:
      - engine_socket_rbind:/var/run/docker.sock
  api_socket:
    image: alpine
    use_api_socket: true
  npipe_engine:
    image: alpine
    volumes:
      - type: npipe
        source: '\\.\pipe\docker_engine'
        target: '\\.\pipe\docker_engine'
volumes:
  engine_socket:
    driver_opts:
      type: none
      device: /var/run/docker.sock
      o: bind
  engine_socket_rbind:
    driver_opts:
      type: none
      device: /run/docker.sock
      o: rbind