---
title: Container engine socket mounted
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > Code Security > Infrastructure as Code (IaC)
  Security > IaC Security Rules > Container engine socket mounted
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Container engine socket mounted

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}).
{% /alert %}

{% /callout %}

## Metadata{% #metadata %}

**Id:** `dockercompose-docker-socket-mounted-in-container` 

**Platform:** DockerCompose

**Severity:** High

**Category:** Access Control

#### Learn More{% #learn-more %}

- [Provider Reference](https://docs.docker.com/reference/compose-file/services/#volumes)

### Description{% #description %}

Mounting a Docker or Podman engine socket into a service grants that container control over the host's container daemon. This can allow it to create privileged containers, modify running workloads, and access other container filesystems, effectively bypassing isolation boundaries. Services should not mount engine sockets directly or through named volumes backed by host bind mounts.

## Compliant Code Examples{% #compliant-code-examples %}

```yaml
services:
  lookalike:
    image: alpine
    volumes: ['/var/run/docker.sock.bak:/var/run/docker.sock']
  target_only:
    image: alpine
    volumes:
      - type: volume
        source: cache
        target: /var/run/docker.sock
  anonymous:
    image: alpine
    volumes: ['/var/run/docker.sock']
  npipe_not_engine:
    image: alpine
    volumes:
      - type: npipe
        source: '\\.\pipe\sql\query'
        target: '\\.\pipe\sql\query'
  no_api_socket:
    image: alpine
    use_api_socket: false
volumes:
  cache: {}
```

## Non-Compliant Code Examples{% #non-compliant-code-examples %}

```yaml
services:
  docker:
    image: alpine
    volumes: ['/var/run/docker.sock:/var/run/docker.sock:ro']
  rootless_podman:
    image: alpine
    volumes:
      - type: bind
        source: /run/user/1000/podman/podman.sock
        target: /run/podman/podman.sock
  windows:
    image: alpine
    volumes: ['\\.\pipe\docker_engine:/docker-engine']
  windows_forward_slashes:
    image: alpine
    volumes: ['//./pipe/docker_engine:/docker-engine']
  named_bind:
    image: alpine
    volumes:
      - engine_socket:/var/run/docker.sock
  named_rbind:
    image: alpine
    volumes:
      - engine_socket_rbind:/var/run/docker.sock
  api_socket:
    image: alpine
    use_api_socket: true
  npipe_engine:
    image: alpine
    volumes:
      - type: npipe
        source: '\\.\pipe\docker_engine'
        target: '\\.\pipe\docker_engine'
volumes:
  engine_socket:
    driver_opts:
      type: none
      device: /var/run/docker.sock
      o: bind
  engine_socket_rbind:
    driver_opts:
      type: none
      device: /run/docker.sock
      o: rbind
```