Docker is the most widely deployed container engine, and its offensive surface is the engine and its supporting services rather than the container boundary, which is a kernel property shared with every other runtime. The daemon API is root-equivalent and frequently reachable over the network; images and registries hold secrets and are a supply-chain target; and the build process is an execution environment that leaks credentials. Escaping a Docker container to the host uses the same primitives as any runtime and is covered under container escape.
docker version 2>/dev/null; docker info 2>/dev/null | grep -iE 'rootless|security'
ss -tlnp 2>/dev/null | grep -E '2375|2376' # daemon exposed over TCP
ls -l /var/run/docker.sock 2>/dev/null # local socket reachable
Subtopics#
- Exposed daemon API: controlling the root-equivalent daemon over the network.
- Images and registries: secrets in images and registry supply-chain attacks.
- Build-time attacks: leaking secrets and exploiting the build process.