<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
# Docker Socket Exposure — API Reference

## Docker Inspect Commands

```bash
# Check mounts on container
docker inspect --format '{{json .Mounts}}' CONTAINER_ID

# List containers with volume details
docker ps --format '{{.ID}} {{.Names}}'
```

## Docker API Endpoints (via Socket)

| Endpoint | Risk | Description |
|----------|------|-------------|
| `GET /version` | Info | Docker version information |
| `GET /containers/json` | High | List all containers |
| `POST /containers/create` | Critical | Create new container |
| `POST /containers/{id}/exec` | Critical | Execute command in container |
| `GET /images/json` | Medium | List images |

```bash
# Test socket access
curl --unix-socket /var/run/docker.sock http://localhost/version
curl --unix-socket /var/run/docker.sock http://localhost/containers/json
```

## kubectl Audit Commands

```bash
# Find socket mounts in pods
kubectl get pods -A -o json | jq '[.items[] | select(.spec.volumes[]?.hostPath.path == "/var/run/docker.sock")]'

# Find socket mounts in deployments
kubectl get deployments -A -o json | jq '[.items[] | select(.spec.template.spec.volumes[]?.hostPath.path == "/var/run/docker.sock")]'
```

## Admission Controller Policy (Kyverno)

```yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: deny-docker-socket
spec:
  validationFailureAction: Enforce
  rules:
    - name: deny-docker-socket-mount
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        message: "Mounting Docker socket is not allowed."
        pattern:
          spec:
            =(volumes):
              - =(hostPath):
                  path: "!/var/run/docker.sock"
```
