"Privilege escalation" implies a vulnerability, but this behavior is by design and -- as the author notes -- already documented. http://docs.docker.com/install

"Privilege escalation" implies a vulnerability, but this behavior is by design and -- as the author notes -- already documented. http://docs.docker.com/installation/ubuntulinux/#create-a-docker-group http://docs.docker.com/installation/ubuntulinux/#create-a-do... > Warning: The docker group is equivalent to the root user; For details on how this impacts security in your system, see Docker Daemon Attack Surface for details. http://docs.docker.com/articles/security/ http://docs.docker.com/articles/security/ > First of all, only trusted users should be allowed to control your Docker daemon. This is a direct consequence of some powerful Docker features. Specifically, Docker allows you to share a directory between the Docker host and a guest container; and it allows you to do so without limiting the access rights of the container. This means that you can start a container where the /host directory will be the / directory on your host; and the container will be able to alter your host filesystem without any restriction. This is similar to how virtualization systems allow filesystem resource sharing. Nothing prevents you from sharing your root filesystem (or even your root block device) with a virtual machine. There's certainly room to discuss "is it possible to delegate hypervisor access without delegating root?", and "can Docker get there from here?", but I think calling this an exploit is pretty far fetched.