Learning Docker - Second Edition

The trusted user control

Since the Docker daemon runs with the root privilege, it has the capability to mount any directory from the Docker host to the container, without limiting any access rights. That is, you can start a container, where the /host directory will be the / directory on your host, and the container will be able to alter your host filesystem without any restriction. This is just an example among a myriad of malicious uses. Considering these activities, the latter versions of Docker restricts the access to the Docker daemon through a UNIX socket. Docker can be configured to access the daemon through the REST API over HTTP if you explicitly decide to do so. However, you should ensure that it will be reachable only from a trusted ...