sdk/python/Command Execution/PyDocker
Command Execution

PyDocker

The docker SDK. DockerClient.containers.run with privileged=True is a container-escape finding. volumes mounting /var/run/docker.sock into the container grants full Docker daemon access.

1 sink
Taint flow0 sources → 1 sink
Sinks — dangerous call
.containers.run()

Sinks

.containers.run()Sink
#
Signature
Container.run(image, command=None, *, privileged=False, volumes=None, ...) -> Container

Runs a container. Finding when privileged=True or docker.sock is mounted.

tracks:0, 1

Other Methods

.from_env()Neutral
#
Signature
docker.from_env(version=None, timeout=60, ...) -> DockerClient

Creates a client from DOCKER_HOST env vars.

Fully-Qualified Names

FQNField
dockerfqns[0]
docker.DockerClientfqns[1]

Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.

Import

rule.py
from codepathfinder.go_rule import PyDocker
Next →PyFcntl