Docker socket escape

docker -H unix:///var/run/docker.sock run -v /:/mnt --rm -it alpine chroot /mnt sh

If the Docker socket (/var/run/docker.sock) is accessible to your user, you are root on the host: mount the root filesystem in an alpine container and chroot to operate directly on the host system.

When you find the Docker socket with write permissions for your user (docker group or 666 permissions). It is one of the most silent escalations: the socket generates no kernel logs and the container is ephemeral with --rm. From the chroot you can read shadow, mount persistence, or deploy a container with more scope.

If the socket is protected (660 permissions with restricted group) or the daemon listens only on TCP with TLS, you have no access. Also do not use it if the host mounts the socket inside containers with user namespaces: access to the socket does not always imply full root on the host.