<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: auditing-docker-socket-exposure
description: >-
  Audit and detect exposed Docker sockets in containers, Kubernetes pods, and
  CI/CD pipelines to prevent container escape and unauthorized container
  management via the Docker API.
domain: cybersecurity
subdomain: container-security
tags:
  - docker-socket
  - docker-api
  - container-escape
  - privilege-escalation
  - ci-cd
  - dind
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1611"]
---

# Auditing Docker Socket Exposure

## Overview

The Docker socket (`/var/run/docker.sock`) provides unrestricted access to the
Docker daemon API. Mounting it inside a container is equivalent to granting root
access to the host. This skill covers identifying socket mounts across local
Docker environments and Kubernetes clusters, recommending alternatives like
Kaniko and Buildah, and deploying admission controls to prevent future exposure.

Mode: `[MODE: BLUE]` — Defensive configuration auditing.

## Prerequisites

| Requirement | Details |
|---|---|
| Docker Engine access for socket inspection | Required |
| kubectl for Kubernetes cluster auditing | Required |
| curl or docker CLI for API testing | Required |
| Falco for runtime detection of socket access | Required |

## Key Concepts

### Docker Socket Exposure Risks

```bash
# Check if Docker socket is mounted in a container
docker inspect --format '{{range .Mounts}}{{if eq .Source "/var/run/docker.sock"}}EXPOSED{{end}}{{end}}' CONTAINER_ID

# List all containers with Docker socket access
docker ps -q | xargs -I{} docker inspect --format '{{.Name}}: {{range .Mounts}}{{if eq .Source "/var/run/docker.sock"}}SOCKET_MOUNTED{{end}}{{end}}' {}

# Test socket access from within container
curl --unix-socket /var/run/docker.sock http://localhost/version
```

### Kubernetes Pod Audit

```bash
# Find pods mounting Docker socket
kubectl get pods --all-namespaces -o json | jq '
  .items[] | select(
    .spec.volumes[]? | select(
      .hostPath.path == "/var/run/docker.sock"
    )
  ) | {namespace: .metadata.namespace, pod: .metadata.name}'

# Check DaemonSets for socket mounts
kubectl get daemonsets --all-namespaces -o json | jq '
  .items[] | select(
    .spec.template.spec.volumes[]? | select(
      .hostPath.path == "/var/run/docker.sock"
    )
  ) | {namespace: .metadata.namespace, name: .metadata.name}'
```

### Docker-in-Docker Alternatives

```yaml
# Instead of mounting Docker socket, use Kaniko for builds
apiVersion: v1
kind: Pod
metadata:
  name: kaniko-build
spec:
  containers:
    - name: kaniko
      image: gcr.io/kaniko-project/executor:latest
      args:
        - "--dockerfile=Dockerfile"
        - "--context=git://github.com/org/repo"
        - "--destination=registry.example.com/app:latest"
```

### Falco Detection Rules

```yaml
- rule: Docker Socket Access in Container
  desc: Detects read/write access to Docker socket from within a container
  condition: >
    (open_read or open_write) and container
    and fd.name = /var/run/docker.sock
  output: >
    Docker socket accessed from container
    (user=%user.name command=%proc.cmdline container=%container.name
     image=%container.image.repository fd=%fd.name)
  priority: WARNING
  tags: [container, docker, mitre_privilege_escalation, T1611]
```

## Workflow

### Step 1: Scan Cluster for Socket Exposure

```bash
node scripts/agent.js --scan-cluster --output /tmp/socket-audit.json
```

### Step 2: Check Local Docker Containers

```bash
node scripts/agent.js --scan-local --output /tmp/local-socket-audit.json
```

### Step 3: Review Findings and Remediate

```bash
cat /tmp/socket-audit.json | jq '.findings[] | select(.risk == "critical")'
```

## Detection

```yaml
title: Auditing Docker Socket Exposure Detection
id: 3ff09a80-d59a-4c63-969b-3bdffb1409fb
status: experimental
description: Detects suspicious activity related to auditing docker socket exposure techniques in container security context
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1611
  - attack.execution
falsepositives:
  - Container orchestration platform performing routine health checks
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Auditing Docker Socket Exposure Detection | kubernetes | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1611 |

## Verification

- [ ] No production pods mount /var/run/docker.sock
- [ ] CI/CD pipelines use Kaniko or Buildah instead of Docker socket
- [ ] Falco rules alert on Docker socket access in containers
- [ ] DaemonSets audited for socket mount requirements
- [ ] Docker API not accessible on TCP without TLS mutual auth
- [ ] Admission controller blocks socket volume mounts

## References

- [Docker Socket Security Risks](https://docs.docker.com/engine/security/)
- [CIS Docker Benchmark 2.1 — Restrict Docker Daemon Socket](https://www.cisecurity.org/benchmark/docker)
- [MITRE ATT&CK T1611 — Escape to Host](https://attack.mitre.org/techniques/T1611/)
- [Kaniko — Build Images Without Docker](https://github.com/GoogleContainerTools/kaniko)
- [NIST SP 800-190 §4.1 — Image and Registry Security](https://csrc.nist.gov/publications/detail/sp/800-190/final)
