Break out of a container through the Docker socket
A mounted or reachable docker.sock is root on the host, because you can start a container that bind-mounts the host filesystem.
Tag: docker
Container breakout through a mounted docker socket
A container with /var/run/docker.sock can start a new privileged container that mounts the host root.