DockerSock Breakout

Abusing docker.sock to create a container that has the root file system mounted in it. With a reverse shell gaining access to the root file system from in the container

info:

Docker.sock is the Unix socket the Docker daemon listens on by default, and it can be used to communicate with the daemon from within a container. and by that can start or stop other containers.

Requirements:

1. Mounted docker.sock in the container as rw with permissions to read and write to the running user
2. Running as root in the container, also in the host. By default docker container runs with the same user NS, if the container is running in a different user NS then the root must be mapped to root. Another option is to run with a user which is part of the docker group.

Exploit:

1. Create http.client with the UNIX socket (docker.sock)
2. send a message to the docker daemon through the UNIX socket to create a reverse shell container with access to the root file system