title: Docker root access to host system
body: <p>When I run a container as a normal user I can map <strong>and modify</strong> directories owned by root on my host filesystem. This seems to be a big security hole. For example I can do the following:</p>
  
  <pre><code>$ docker run -it --rm -v /bin:/tmp/a debian
  root@14da9657acc7:/# cd /tmp/a
  root@f2547c755c14:/tmp/a# mv df df.orig
  root@f2547c755c14:/tmp/a# cp ls df
  root@f2547c755c14:/tmp/a# exit
  </code></pre>
  
  <p>Now my <strong>host</strong> filesystem will execute the <code>ls</code> command when <code>df</code> is typed (mostly harmless example). I cannot believe that this is the desired behavior, but it is happening in my system (debian stretch). The <code>docker</code> command has normal permissions (755, not setuid).</p>
  
  <p>What am I missing?</p>
  
  <p>Maybe it is good to clarify a bit more. I am not at the moment interested in what the container itself does or can do, nor am I concerned with the root access inside the container.</p>
  
  <p>Rather I notice that anyone on my system that can run a docker container can use it to gain root access to my <strong>host</strong> system and read/write as root whatever they want: effectively giving all users root access. That is obviously not what I want. How to prevent this?</p>