ashleyt3/docker-socket-risk-demosCompanion source for YouTube video "Stop Mounting docker.sock — Run Trivy Without Giving Away Root Access — (inspired by CVE-2026-33634)"
Companion repo for the video: Stop Mounting docker.sock — Run Trivy Without Giving Away Root Access — (inspired by CVE-2026-33634)
https://www.youtube.com/watch?v=xLTYzfPY3xI
This repo contains the sample web app and Claude Code prompt used in the video to demonstrate:
/var/run/docker.sock into a container gives that container root-level access to your hostdocker save + a read-only tar bind mount instead of the Docker socket APImy-calc-app/A Next.js/React calculator app with a multi-stage production Dockerfile (node:20-alpine, non-root user). This is the app scanned by Trivy in the video.
Build and run:
cd my-calc-app
docker build -t my-calc-app:prod .
docker run -p 3000:3000 my-calc-app:prod
The app will be available at http://localhost:3000.
Note: The file public/secret.txt contains a dummy RSA private key. This is intentional — it exists so that Trivy's secret scanner catches it during the first scan in the video, demonstrating Trivy's secret detection capability. It is not a real key.
prompts/trivy-report-for-prod-docker-prompt.mdThe Claude Code prompt used in the video to analyze Trivy JSON scan output. It classifies vulnerabilities by location (app dependencies vs. OS packages vs. npm/yarn internals) and produces a release/no-release verdict.
To use it with your own image:
# 1. Export your image as a tar file
docker save my-calc-app:prod -o my-calc-app-prod.tar
# 2. Run Trivy against the tar (no docker.sock needed)
docker run --rm \
-v trivy-cache:/root/.cache/ \
-v ./my-calc-app-prod.tar:/image.tar:ro \
aquasec/trivy:latest image --input /image.tar -f json > report.json
# 3. Ask Claude Code to analyze the report
claude -p "$(cat prompts/trivy-report-for-prod-docker-prompt.md) report.json"
Instead of:
# Gives the container full root access to your host via Docker API
docker run -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy image my-app:latest
Do this:
# 1. Save the image to a tar file
docker save my-calc-app:prod -o my-calc-app-prod.tar
# 2. Bind-mount only the tar file (read-only), no socket access
docker run --rm \
-v trivy-cache:/root/.cache/ \
-v ./my-calc-app-prod.tar:/image.tar:ro \
aquasec/trivy@sha256:<pin-to-digest> image --input /image.tar -f json > report.json
Pin the Trivy image with a SHA256 digest instead of a tag to resist supply chain attacks like CVE-2026-33634.