Host Your Blog on DigitalOcean with Docker, Nginx and Let’s Encrypt
&gt; volumes: - &#x2F;var&#x2F;run&#x2F;docker.sock:&#x2F;var&#x2F;run&#x2F;docker.sock:ro<p>Please for the love of all that is holy, do not ever do this! Giving access to the host&#x27;s Docker socket is <i>equivalent</i> to giving a container <i>unrestricted root access to your host</i>. Mounting the socket read-only doesn&#x27;t protect you in any way either, because you can still connect to and write to the socket! Seriously, try it:<p><pre><code>    % touch &#x2F;tmp&#x2F;docker.sock
    % mount --bind -o ro &#x2F;var&#x2F;run&#x2F;docker.sock &#x2F;tmp&#x2F;docker.sock # this is -v &#x2F;var&#x2F;run&#x2F;docker.sock:&#x2F;foo:ro
    % docker -H unix:&#x2F;&#x2F;&#x2F;tmp&#x2F;docker.sock run --privileged -v &#x2F;:&#x2F;host -it ubuntu bash
    # # I couldn&#x27;t write to it, but I can connect and write to the connection...
    # cat &#x2F;host&#x2F;etc&#x2F;shadow # whoops!
</code></pre>
(The full container escape is left as an exercise for the reader. It&#x27;s pretty trivial though.)<p>To be fair, there are unix-like DAC controls that do restrict this somewhat but given that most people run containers as root or they don&#x27;t use user namespaces this is still an issue.<p>Please stop doing this, please stop telling people to do this, and please stop making images that access docker.sock. I understand that this is something that a lot of people do, so it&#x27;s obviously not exclusively the fault of the author for doing what the majority of people appear to be doing, but I think that this deserves to be said much stronger than it was in the past (people still expose Docker over the internet -- which is literally a free root-level RCE for anyone who figures out you&#x27;re hosting it).<p>And yes, AuthZ plugins exist but nobody really uses them as far as I&#x27;m aware -- and personally (as someone who maintains container runtimes and other low-level container tools) I would not feel confident in depending on any AuthZ plugin&#x27;s profile to protect against a container escape where you give unprivileged users access to &#x2F;var&#x2F;run&#x2F;docker.sock. Even if I were to write one.