docker cp is Docker’s file-transfer command for copying files and directories between a container and the host filesystem. It is useful for debugging, backups, and moving build artifacts, but it crosses a trust boundary.
Security matters because the command must resolve paths, permissions, and links correctly. If an attacker can influence container content, a careless docker cp operation may overwrite host files, place malicious scripts in a writable location, or expose sensitive data. Defenders should treat it like a privileged operation: copy only from trusted containers, review destination paths, avoid unnecessary elevation, and be cautious with symlinks and automation. In real attacks and security reviews, file-copy features are often tested for path traversal, overwrite behavior, and host-impacting side effects.