Skip to main content

Exploit chains

Most scanners evaluate one artefact at a time. A Compose stack is not one artefact - it is a set of services with a network topology, and some of the most serious problems only exist in the relationships between them.

The idea​

Consider a stack where:

  • web mounts /var/run/docker.sock
  • web publishes port 80 on 0.0.0.0

Reported separately, those are a MEDIUM and a LOW. Reported together, they are a path from the public internet to root on the host: anything that achieves remote code execution in web already has the container escape available.

DockSec reports that as one CRITICAL chain, names the rules it combines, and ends with the single change that breaks it.

A real example​

Exploit chains
  [CRITICAL] 'web' publishes a port and mounts the Docker socket
      services: web
      combines: compose-docker-socket-mount, compose-port-bound-all-interfaces

      'web' is reachable from outside the host and mounts the Docker socket.
      Any remote code execution in this service is a host compromise rather
      than a container one: the escape path is already open, so the container
      boundary provides no containment.

      break it: Remove the socket mount first - it is what turns a service
                compromise into a host compromise.

And one that spans two services:

  [HIGH] 'db' is internet-facing and can reach 'web' with a committed credential
      services: db, web
      combines: compose-plaintext-secret-env, compose-no-network-segmentation

      Neither service looks critical on its own.

That last line is the point. Both findings are individually unremarkable.

How it works​

Chains are detected deterministically from the Compose graph - exposed port, weak credential, shared network and socket mount are a graph query, not an inference problem. That means they work with --scan-only, offline, and with no API key.

When the AI pass is enabled it explains and ranks the chains, and may catch cases the rules miss. It does not discover them on its own, so the flagship feature never depends on a model being available.

Limits​

Chains cover Compose only - not Kubernetes, not Helm, and not chains spanning a Dockerfile and a Compose file. Chain detection also does not prove exploitability: it proves the preconditions are all present in the same stack.

See what it does not do for the full list.