Docker

OVERVIEW

Docker (docker.com) is the container engine and CLI most hosts run: the `docker` client talks to the `dockerd` daemon over a Unix socket (or, if misconfigured, a TCP port) to build, run, and manage containers and images. In a pentest it's both a target and a tool — an exposed daemon socket mounted inside a container, or a user in the `docker` group, is a well-known path to root on the host, since anyone who can talk to the socket can run a privileged container that mounts the host filesystem.

Beyond the escape angle, `docker inspect`, `docker history`, and `docker save`/`export` are the everyday commands for pulling apart a running container or its image to look for hardcoded secrets, loose capabilities, or a writable host mount, without needing Dive or Crane for a quick look.

USE CASES

Practical use cases

• 01

  Enumerating running containers, their mounts, and their capabilities on a compromised host.

• 02

  Checking for an exposed Docker socket (host TCP port, or mounted into another container) as a root-escalation path.

• 03

  Inspecting an image with `docker history`/`inspect` for hardcoded secrets or risky build steps.

• 04

  Confirming whether a user account belongs to the `docker` group, which is effectively root on the host.

QUICK START

Once you have a foothold on a host running Docker, to enumerate containers/images and check for escape paths to the underlying node.

1. Confirm the host and any container breakout technique are explicitly in scope, since this affects the underlying node.
2. Check for the `docker` CLI and an accessible daemon socket (`/var/run/docker.sock` or a TCP endpoint).
3. Run `docker ps` / `docker inspect` to enumerate running containers, mounts, and capabilities.
4. If the socket is reachable, test whether it grants effective host root before treating it as a confirmed finding.

docker -H unix:///var/run/docker.sock inspect $(docker ps -q)

BEFORE YOU RUN IT

What to check before running it