Never mount the Docker socket into a container

Mounting /var/run/docker.sock gives the container the Docker API, and the OWASP cheat sheet's first rule explains that this is effectively root on the host.

If a tool really needs to manage containers, such as a CI runner:

• run it on a dedicated host, or
• use a rootless setup.

Do not reach for --privileged to fix a permissions error either; it removes most of the isolation too.

To check nothing mounts the socket by accident, search your Compose files and run scripts for docker.sock.