Can anyone explain docker.sock

问题:

I am trying to understand the actual reason for mounting docker.sock in docker-compose.yml file. Is it for auto-discovery?

volumes:
  - /var/run/docker.sock:/var/run/docker.sock

回答1:

docker.sock is the UNIX socket that Docker daemon is listening to. It's the main entry point for Docker API. It also can be TCP socket but by default for security reasons Docker defaults to use UNIX socket.

Docker cli client uses this socket to execute docker commands by default. You can override these settings as well.

There might be different reasons why you may need to mount Docker socket inside a container. Like launching new containers from within another container. Or for auto service discovery and Logging purposes. This increases attack surface so you should be careful if you mount docker socket inside a container there are trusted codes running inside that container otherwise you can simply compromise your host that is running docker daemon, since Docker by default launches all containers as root.

Docker socket has a docker group in most installation so users within that group can run docker commands against docker socket without root permission but actual docker containers still get root permission since docker daemon runs as root effectively (it needs root permission to access namespace and cgroups).

I hope it answers your question.

More info: https://docs.docker.com/engine/reference/commandline/dockerd/#examples