Containers should not mount the Docker socket docker.sock inside them

Docs > Datadog Security > OOTB Rules > Containers should not mount the Docker socket docker.sock inside them

Classification:

compliance

Framework:

cis-docker

Control:

5.31

Set up the docker integration.

Description

The Docker socket docker.sock should not be mounted inside a container.

Rationale

If the Docker socket is mounted inside a container it could allow processes running within the container to execute Docker commands which would effectively allow for full control of the host.

Audit

Run this command: docker ps --quiet --all | xargs docker inspect --format '{{ .Id }}: Volumes={{ .Mounts }}' | grep docker.sock This returns any instances where docker.sock has been mapped to a container as a volume.

Remediation

You should ensure that no containers mount docker.sock as a volume.

Impact

None

Default value

By default, docker.sock is not mounted inside containers.

References

CIS controls

Version 6

9 Limitation and Control of Network Ports, Protocols, and Services