Docker Socket Hardening: Stop Mounting Root-Equivalent Into Every Container
Your containers stop being a free elevator to the host — and you can prove it with one deliberate test. Audit the raw /var/run/docker.sock mounts, front them with Tecnativa's socket proxy (pinned v0.5.0), then userns-remap or rootless for structural isolation.