CV-C002: Docker socket mounted
Error Security
Why This Matters
Mounting the Docker socket (/var/run/docker.sock) inside a container grants it root-level control over the host Docker daemon. Any process in the container can create, start, stop, or remove containers, pull images, and effectively gain full host root access. CWE-250: Execution with Unnecessary Privileges.
How to Fix
Use a Docker API proxy with limited permissions, or avoid socket mounting entirely
Before (incorrect)
services:
web:
volumes:
- /var/run/docker.sock:/var/run/docker.sockAfter (correct)
services:
web:
volumes:
- ./app-data:/dataRule Details
- Rule Code
- CV-C002
- Severity
- Error
- Category
- Security