AG-DOCKER-EXEC: Container Escape Vector: docker run

What this rule means

A function shells out to `docker run` with tool-controlled arguments. An attacker via prompt injection can supply arbitrary docker flags — volume mounts (`-v /:/host`), privileged mode, host networking, or a malicious image.

Why it matters

The pattern is generic to any agent that wraps the docker CLI rather than a constrained sandboxing API — the same class of risk as shelling out to any privileged binary with unvalidated arguments.

How to fix it

Remove docker-exec capability from agent tools, or use a real sandboxing API (gVisor, Firecracker). If docker is required, allowlist the image and strip -v/--privileged/--network/--cap-add.

Detect it

pip install lucin
lucin scan .                  # all rules
lucin explain AG-DOCKER-EXEC          # this rule, in your terminal

Findings carry a file:line and, where the rule supports it, a witness path showing the flow that triggered it. Precision and recall for the whole rule set, with the commands that regenerate them, are on the benchmarks page — and the gaps are on limits.

← All detection rules