The Docker socket is the control interface used to talk to the Docker daemon, usually through the Unix socket /var/run/docker.sock. It is not a normal data file: requests sent to this socket can start, stop, inspect, or reconfigure containers, images, and volumes. Because the Docker daemon often runs with root privileges, access to the socket can effectively become host-level control.
In cyber security, exposed Docker sockets are a common escalation path. An attacker who can read or write the socket may launch a privileged container, mount the host filesystem, or execute commands on the underlying machine. This can turn a small foothold inside a container or management app into full system compromise. Defenders reduce the risk by keeping the socket off the network, avoiding unnecessary socket mounts into containers, using rootless or least-privilege Docker setups, and tightly controlling which users or services can access it.