Q: Your DevOps engineering team is designing a scalable CI/CD build runner infrastructure on Kubernetes and virtual machines. One group of engineers mounts the host's `/var/run/docker.sock` into worker containers (DooD) to build and push container images. Another team uses `docker:dind` requiring `--privileged` mode. A recent security audit flagged both approaches as critical vulnerabilities. You must evaluate the operational and security trade-offs of DinD versus DooD, identify specific escape vectors, and transition the CI infrastructure to rootless daemonless builders.

Exposing `/var/run/docker.sock` inside a container provides full control over the host's Docker daemon. Any build step or rogue script can execute `docker run -v /:/host alpine` and gain immediate, unrestricted root access to the underlying host filesystem.

# Exploit demonstration: Gaining host root via mounted Docker socket
# Inside a DooD worker container:
docker run -it --rm -v /:/host alpine chroot /host
# Attacker now possesses full root shell on the host OS!

DinD runs an independent nested Docker daemon inside the container. However, it requires running the container in `--privileged` mode to configure nested cgroups, AppArmor profiles, and overlayfs storage drivers. Privileged mode disables all container isolation boundaries.

# Running DinD requires full privileged mode
docker run --privileged --name dind-builder -d docker:dind

# Major Pitfall: Nested OverlayFS on OverlayFS
# Earlier storage drivers suffered filesystem corruption and inode leaks
# Modern DinD uses 'vfs' or rootless fuse-overlayfs

Evaluate operational factors: DooD shares the host image cache, resulting in fast builds, but risks container ID collisions, resource contention, and catastrophic host takeovers. DinD provides isolated cache per worker, but incurs cold cache download overhead and requires privileged host access.

Feature Comparison:
- DooD (/var/run/docker.sock):
  - Security: CRITICAL (Complete Host Root Takeover)
  - Cache: Shared with Host (Fast)
  - Requires Privileged?: NO
- DinD (docker:dind):
  - Security: HIGH RISK (Requires --privileged capability)
  - Cache: Isolated per Job (Slow without remote cache)
  - Requires Privileged?: YES

Eliminate both DinD and DooD by adopting daemonless container builders such as Google Kaniko or Red Hat Buildah. These tools build OCI images directly in user space without requiring Docker daemon sockets or privileged permissions.

apiVersion: v1
kind: Pod
metadata:
  name: secure-kaniko-builder
spec:
  restartPolicy: Never
  containers:
    - name: kaniko
      image: gcr.io/kaniko-project/executor:latest
      args:
        - "--dockerfile=Dockerfile"
        - "--context=dir:///workspace"
        - "--destination=registry.example.com/app:v1"
        - "--cache=true"
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop: ["ALL"]