Why the Docker socket and docker group equal root, and safer alternatives

The socket is an admin API

The Docker daemon runs as root and listens on /var/run/docker.sock. Anyone who can write to that socket can ask the daemon to start a privileged container with the host filesystem mounted, which is equivalent to root on the host. Adding a user to the docker group grants exactly that access, which is why Docker’s own documentation warns that the group grants root-level privileges.

Mounting the socket into a container, a pattern used by some CI agents and monitoring tools, extends the same power to anything that compromises that container.

Finding exposure

Check group membership on hosts, and look for containers and pods that mount the socket. In Kubernetes, a hostPath to docker.sock or containerd.sock is blocked by the baseline Pod Security level, which is one more reason to enforce it.

getent group docker
docker ps -q | xargs -r docker inspect --format '{{.Name}} {{range .Mounts}}{{.Source}} {{end}}' | grep -E 'docker.sock|containerd.sock'
kubectl get pods -A -o json | jq -r '.items[] | select(.spec.volumes[]?.hostPath.path? | test("docker.sock|containerd.sock")?) | .metadata.namespace + "/" + .metadata.name'

Lab: reason about it safely

On a disposable VM you own, add a test user to the docker group and, as that user, run docker run --rm -v /:/host alpine ls /host/root. The listing of root’s home directory shows the user can read any file on the host without sudo. Remove the user from the group and confirm the command fails with a permission error on the socket. Delete the VM afterward.

Alternatives

Run Docker in rootless mode, or use Podman, which can run without a root daemon. For image builds in CI, use BuildKit in rootless mode, Kaniko, or Buildah, which do not need the host socket. Restrict the docker group to administrators who already have sudo.