I'm new to docker and in a workplace where employees are added to the docker group to enable us to launch docker containers (and all things docker). We're aware that docker has a vulnerability which can allow a user to gain root access to the host machine. An example showing elevated access is demonstrated:

docker pull ubuntu:22.04
docker run -it -v /:/host:rw ubuntu:22.04
echo "oops" > /host/test.txt
cat /test.txt

We're hoping to implement some security features which will prevent this and would like some guidance on best industry practice.

So far we have looked into a variety of ways however we are not sure which to approach. We have looked into Rootless Docker, however we would rather not use this approach as we would like root in the containers we create.

We've also seen that containers can be isolated.

We've also looked into Open Source and Paid third party software that might fix the issue such as Sysbox

If anyone has any more experience handling this problem, it would be great to have any input on the matter! Bonus points if the setup means that containers on the host can only be viewed and managed by those users who created them, such that: docker system prune does not remove other user's resources.

  • (a) Docker doesn't "have a vulnerability"; docker access is equivalent to root access by design. (b) You can still have root access inside containers when running rootless Docker; that's sort of the whole point. (c) Higher level tooling like Kubernetes offers better control over security (at the cost of more complexity).
    – larsks
    Jan 6 at 3:33


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.