Absolutely. Docker is a boiling mess of baked-in convenience workarounds (ie vulns). It's an orchestration layer (like k8s with containers), not a real security boundary like VMs. OTOH, single-purpose VMs are basically just as easy these days and those can still pull in containers as needed.
Take a look at docker-socket-proxy as a somewhat of a counter to this issue:
https://github.com/Tecnativa/docker-socket-proxy
Do you know about docker compose overwriting your carefully set firewall rules? That’s the other docker thing…
Go on, what other docker things should we know?
Absolutely. Docker is a boiling mess of baked-in convenience workarounds (ie vulns). It's an orchestration layer (like k8s with containers), not a real security boundary like VMs. OTOH, single-purpose VMs are basically just as easy these days and those can still pull in containers as needed.