rules:
- id: exposing-docker-socket-volume
  patterns:
  - pattern-inside: |
      version: ...
      ...
  - pattern-either:
    - pattern: |
        volumes:
          - ...
          - /var/run/docker.sock:/var/run/docker.sock
          - ...
    - pattern: |
        volumes:
          - ...
          - /run/docker.sock:/run/docker.sock
          - ...
    - pattern: |
        volumes:
          - ...
          - /var/run/docker.sock:/run/docker.sock
          - ...
    - pattern: |
        volumes:
          - ...
          - /run/docker.sock:/var/run/docker.sock
          - ...
    - pattern: |
        volumes:
          - ...
          - /var/run/docker.sock
          - ...
    - pattern: |
        volumes:
          - ...
          - /run/docker.sock
          - ...
    - pattern: |
        volumes:
          - ...
          - ...
            source: /var/run/docker.sock
            ...
          - ...
    - pattern: |
        volumes:
          - ...
          - ...
            source: /run/docker.sock
            ...
          - ...
  message: >-
    Exposing host's Docker socket to containers via a volume. The owner of this
    socket is root. Giving someone access to it is equivalent to giving
    unrestricted root access to your host. Remove 'docker.sock' from volumes to
    prevent this.
  metadata:
    references:
    - https://docs.docker.com/compose/compose-file/compose-file-v3/#volume-configuration-reference
    - https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-1-do-not-expose-the-docker-daemon-socket-even-to-the-containers
    category: security
    technology:
    - docker-compose
    cwe:
    - 'CWE-250: Execution with Unnecessary Privileges'
    owasp:
    - A06:2017 - Security Misconfiguration
    - A05:2021 - Security Misconfiguration
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    confidence: LOW
  languages: [yaml]
  severity: WARNING