I think the question about Docker security in general was already well answered in other places, for example here: https://stackoverflow.com/questions/40844197/what-is-the-docker-security-risk-of-var-run-docker-sock
In your particular instance, I see the following points:
The tests should run on some testing server, possibly even in a VM that is destroyed/...
The git hooks approach could probably work fine for lone developers. But when multiple developers work on the same project it doesn't work so well, especially in large scale projects.
the git hooks are local to your copy of the repository, there is no check for consistency across all developers. Anyone can "adjust" their hook script as ...
Running your config.yml through yamllint, produced the following:
1:1 warning missing document start "---" (document-start)
13:3 error duplication of key "build" in mapping (key-duplicates)
25:19 error syntax error: mapping values are not allowed here
When I add colons to the entry on lines 25 and 28:
You simply have an incorrect yaml syntax in your workflows jobs list.
From what I could very quickly understand on circleCI's documentation, jobs names are accepted as a shorthand if you don't define any parameters. If you have parameters, the list element is a hashmap with top element being the job name. In your specific case, this should give (note the ...