The DevOpsBeast Blog

Production engineering notes.

Field notes on Kubernetes, GPUs, Linux, and the rest of the production stack, from engineers who run real infrastructure.

RSS·subscribe in your feed reader
All (42)Container Internals (1)Container Security (1)DevOpsBeast (2)GPU (1)GPU Cost Optimization (1)GPU Infrastructure (3)Kubernetes (1)Kubernetes Architecture (1)Kubernetes Debugging (4)Kubernetes Networking (2)Kubernetes Operations (2)Kubernetes Performance (1)Kubernetes Security (2)Linux (2)LLM Infrastructure (7)Networking (2)Observability (1)Security (8)
Container Security··6 min read

Mounting the Docker Socket Is Root on Your Host. Here Is Why.

A CI job mounts /var/run/docker.sock so it can build images. An attacker who compromises that job uses the socket to start a privileged container that mounts the host root filesystem. No exploit required. This is one of the most common real-world container escapes, and the fix is to stop needing the socket at all.

Read post