The Docker socket is root on the host
A Compose volume for /var/run/docker.sock lets that container talk to the Docker API on the host.
The socket is the Docker API
The usual Compose line is `/var/run/docker.sock:/var/run/docker.sock`. The socket is the Docker API. A process that can write to it can create a container, mount the host filesystem, and start that container as root. The mount does not drop that privilege.
A Kubernetes `hostPath` of `/var/run/docker.sock` is the same kind of mount. The Docker socket check looks for a socket mount or another host path, including that Compose volume. It reads the manifest or Compose file. It does not inspect a running host. A socket mounted only at runtime, outside the file, is outside the check. `privileged: true` on a Kubernetes container is a different check.
Mount the directory the job needs
Ask for the directory the job writes, such as `./artifacts:/work`, or a named volume. Those cannot start a container on the host. If the job must build an image, keep the builder outside the app container and give it a credential for one repository.
Paste the file and quote the volume line. If a tool's setup says to mount the socket, that sentence is the thing to question.