---
title: Containers should not mount the Docker socket docker.sock inside them
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Containers should not mount the Docker
  socket docker.sock inside them
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Containers should not mount the Docker socket docker.sock inside them
Classification:complianceFramework:cis-dockerControl:5.32 
## Description{% #description %}

Containers should leave the Docker socket unmounted.

## Rationale{% #rationale %}

A container that mounts the Docker socket can start a privileged container, and through it take over the host.

## Audit{% #audit %}

Inspect the containers:

```bash
docker ps --quiet --all | xargs docker inspect --format '{{ .Name }}: Volumes={{ .Mounts }}'
```

Datadog fails the rule when a container mounts a path named `docker.sock`, or binds `/`, `/run` or `/var/run`, which hold the socket, and passes it otherwise. A read-only mount fails too: it still allows every call of the API. The Datadog Agent and Cluster Agent images from the Datadog registries pass: they mount the socket by design.

## Remediation{% #remediation %}

Remove the mount of the Docker socket from the container.

## Impact{% #impact %}

A tool that manages Docker from a container needs another access path, such as a proxy that allows only the API calls it needs.

## Default value{% #default-value %}

Containers mount the host paths that their command asks for.

## References{% #references %}

1. [https://docs.docker.com/reference/cli/dockerd/#daemon-socket-option](https://docs.docker.com/reference/cli/dockerd/#daemon-socket-option)