Skip to main content

☑️ Prevent containers from mounting Docker socket

It is recommended to disallow Docker socket access to all pods running on a cluster. When a container has access to the Docker socket, it can effectively manage other containers on the host.

Targeted resources by this rule (types of kind): Deployment / Pod / DaemonSet / StatefulSet / ReplicaSet / CronJob / Job

Enabled by default? False

Policy as code identifier: CONTAINERS_INCORRECT_PATH_VALUE_DOCKERSOCKET


This rule will fail

If one of the volumes is targeting the /var/run/docker.sock path

spec:
volumes:
- name: docker-sock-volume
hostPath:
path: /var/run/docker.sock
containers:
- name: app
image: nginx:1.19.8
volumeMounts:
- mountPath: /var/run/docker.sock

Rule output in the CLI

$ datree test *.yaml

>> File: failExample.yaml
❌ Prevent containers from mounting Docker socket [1 occurrence]
💡 Incorrect value for key `path` - avoid mounting the docker.socket becasue it can allow container breakout

How to fix this failure

Avoid mounting the Docker socket

spec:
containers:
- name: app
image: nginx:1.19.8

Read more