# The Docker socket is root on the host

A Compose volume for /var/run/docker.sock lets that container talk to the Docker API on the host.

Published 2026-10-12.

## The socket is the Docker API

The usual Compose line is `/var/run/docker.sock:/var/run/docker.sock`. The socket is the Docker API. A process that can write to it can create a container, mount the host filesystem, and start that container as root. The mount does not drop that privilege.

A Kubernetes `hostPath` of `/var/run/docker.sock` is the same kind of mount. The Docker socket check looks for a socket mount or another host path, including that Compose volume. It reads the manifest or Compose file. It does not inspect a running host. A socket mounted only at runtime, outside the file, is outside the check. `privileged: true` on a Kubernetes container is a different check.

## Mount the directory the job needs

Ask for the directory the job writes, such as `./artifacts:/work`, or a named volume. Those cannot start a container on the host. If the job must build an image, keep the builder outside the app container and give it a credential for one repository.

Paste the file and quote the volume line. If a tool's setup says to mount the socket, that sentence is the thing to question.

## Related

- [Container privilege review](https://skaleagents.com/resources/container-privilege-review)
- [Docker socket check](https://skaleagents.com/checks/docker-socket)
- [Elevated container check](https://skaleagents.com/checks/elevated-container-privileges)