What is the purpose of the file “docker.sock”?

by

docker.sock is the UNIX socket that Docker daemon is listening to. It’s the main entry point for Docker API. It also can be TCP socket but by default for security reasons Docker defaults to use UNIX socket.

Docker cli client uses this socket to execute docker commands by default. You can override these settings as well.

There might be different reasons why you may need to mount Docker socket inside a container. Like launching new containers from within another container. Or for auto service discovery and Logging purposes. This increases attack surface so you should be careful if you mount docker socket inside a container there are trusted codes running inside that container otherwise you can simply compromise your host that is running docker daemon, since Docker by default launches all containers as root.

Docker socket has a docker group in most installation so users within that group can run docker commands against docker socket without root permission but actual docker containers still get root permission since docker daemon runs as root effectively (it needs root permission to access namespace and cgroups).

I hope it answers your question.

More info: https://docs.docker.com/engine/reference/commandline/dockerd/#examples

More Related Contents:

  1. Docker Compose wait for container X before starting Y
  2. How to fix docker: Got permission denied issue
  3. What is the difference between docker-compose ports vs expose
  4. How to mount a single file in a volume
  5. Docker Compose – Share named volume between multiple containers
  6. Access docker container from host using containers name
  7. Provide static IP to docker containers via docker-compose
  8. Docker-Compose persistent data MySQL
  9. How to get docker-compose to always re-create containers from fresh images?
  10. How to set a path on host for a named volume in docker-compose.yml
  11. Docker COPY from ubuntu absolute path
  12. Docker Compose – How to execute multiple commands?
  13. How to mount local volumes in docker machine
  14. An error, “failed to solve with frontend dockerfile.v0”
  15. Difference between links and depends_on in docker_compose.yml
  16. What is the alternative to condition form of depends_on in docker-compose Version 3?
  17. Docker Compose keep container running
  18. How to pass ARG value to ENTRYPOINT?
  19. How can I use environment variables in docker-compose?
  20. How to restart a single container with docker-compose
  21. How to pass arguments to a Dockerfile?
  22. How to tag docker image with docker-compose
  23. how do you manage secret values with docker-compose v3.1?
  24. Docker-compose exit code is 137 when there is no OOM exception
  25. docker-compose: difference between networks and links
  26. How to directly mount NFS share/volume in container using docker compose v3
  27. Substitute environment variables in NGINX config from docker-compose
  28. Build a single image based on docker compose containers
  29. Difference between “docker compose” and “docker-compose”
  30. How to define build-args in docker-compose?

Leave a Comment