Docker Socket Exposed to Container

critical

Detects services that mount the Docker socket, giving the container full control over the Docker daemon, equivalent to unrestricted root access to the host.

Rule Information

Language
Docker Compose
Category
Container Security
Author
Code Pathfinder Team
Last Updated
2024-12-19
Tags
docker-composesecuritydocker-socketprivilege-escalationcontainer-escapecritical
CWE References
CWE-250

Interactive Playground

Experiment with the vulnerable code and security rule below. Edit the code to see how the rule detects different vulnerability patterns.

pathfinder scan --rule cpf/docker-socket-exposed
Vulnerable Code
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
Security Rule

Similar Rules

Explore related security rules for Docker Compose

high

Dangerous Capability Added

Detects services that add dangerous Linux capabilities like SYS_ADMIN, SYS_MODULE, or SYS_PTRACE which can be used for container escape or privilege escalation.

medium

Using Host IPC Mode

Detects services using host IPC namespace, allowing the container to share shared memory segments, semaphores, and message queues with the host system.

high

Using Host Network Mode

Detects services using host network mode, which disables network isolation and makes the container share the host's network stack, bypassing Docker's network isolation.

Frequently Asked Questions

Common questions about Docker Socket Exposed to Container

Detects services that mount the Docker socket, giving the container full control over the Docker daemon, equivalent to unrestricted root access to the host.
This vulnerability is rated as critical severity, which means it requires immediate attention and can lead to severe security breaches such as remote code execution, complete system compromise, or massive data breaches.

Use Code Pathfinder to scan your Docker Compose codebase and automatically detect instances of this vulnerability pattern. Install Code Pathfinder and run the following command in your project directory:

pathfinder scan --rule cpf/docker-socket-exposed

This rule is aligned with industry-standard security frameworks and classifications:

  • CWE (Common Weakness Enumeration): CWE-250
  • Tags: docker-compose, security, docker-socket, privilege-escalation, container-escape, critical
Yes! Code Pathfinder allows you to customize rules to match your specific security requirements and coding standards. You can modify the detection patterns, adjust severity levels, add custom sanitizers, and configure the rule to fit your organization's security policies. The interactive playground above lets you experiment with the rule and see how it behaves with different code patterns.
When this vulnerability is detected in your code, review the flagged instances carefully. Check the "Vulnerable Code" section above for examples of insecure patterns and the "Security Rule" section to understand what the rule is looking for. Follow security best practices for Docker Compose and consult the CWE/CVE references for detailed remediation guidance. Always test your fixes thoroughly before deploying to production.
Back to Container SecurityAll Languages →