Docker / container daemon abuse

When it applies

You can reach a container control plane you shouldn't: an unauthenticated Docker API on 2375/tcp (or 2376 without client-cert auth), a mounted /var/run/docker.sock inside a container you control, membership in the docker group, or a privileged/host-mounted container. Any of these is effectively root on the host. Complements cloud-container-escape (which focuses on kernel/runtime breakouts); this one is about the daemon/socket as the vector.

Why it works

The Docker daemon runs as root and will build/run any container with any mount you ask for. Anyone who can talk to its API or socket can start a container that bind-mounts the host filesystem (-v /:/host) or runs --privileged — then read/write host files, add a root user, or chroot in. There's no privilege boundary between "can use the daemon" and "root on the host".