It depends the specific version of docker and the containers you are running. And how you are using your containers.
While the dream is that a container is isolated from the host, there have been times when a bug or vulnerability has been discovered that has allowed a container to gain root access to the host system or, more commonly, being able to damage the host. Easy ways to damage the host:
- Getting a container to cause a kernel panic on the host.
- Denial of service (there are various resources that a container can hog to starve the host's other systems).
- A developer, perhaps foolishly, mounting a volume as read/write and the dangerous container damaging or obscuring something.
The roles of your containers also add additional security vulnerabilities:
- Say if a tiny-proxy docker container is a poisoned image. Suddenly you could have an interloper tracking all the requests in the network and determining your topology.
- Or perhaps your containers talk to each other on an encrypted private network and without authentication. One poisoned image as a layer to one of your custom containers is a key to compromising the whole system.
- Or maybe your vault docker container is the rouge image. Now you've just feed your keys to a phony container.