title: What is the Docker security risk of /var/run/docker.sock?
body: <p>In <a href="https://blog.docker.com/2016/06/building-serverless-apps-with-docker/" rel="noreferrer">this blog article</a>, I found the quote below in a comment:</p>
  
  <blockquote>
    <p>Ben Firshman</p>
    
    <p>Yes – you're right I should have pointed out the security issue with the Docker socket. That's currently the main blocker to this being practical in production and we're definitely looking for help to make it work better, as you noticed from the to-do list.</p>
  </blockquote>
  
  <p>While I am sure this made sense to many, for the rest of us, could someone explain in clear terminology exactly what this "security issue" is?  I assume it refers to:</p>
  
  <pre><code>    volumes:
    - "/var/run/docker.sock:/var/run/docker.sock"
  </code></pre>
  
  <p>in the docker-compose file.  Is that correct?  How would this be exploited?  Does this effectively prohibit this approach from Production usage?  If so, is there a workaround?</p>