A municipal low-privilege account is a member of the Docker group on a Linux host. Conceptually, how should the tester frame that membership?
Select an answer to reveal the explanation.
Short Explanation
Membership in the Docker club is often like holding the keys to the whole machine, not just a peek at a guest list. Control of the Docker socket frequently means you can run containers that punch through to the host. Treat it as root-equivalent risk class, not a harmless convenience group.
Full Explanation
A municipal low-privilege account in the Docker group (or with docker.sock access) should be framed as often root-equivalent on the host: container engines typically allow mounting the host filesystem or escaping into host namespaces from that trust level. Treat group membership as a critical local privilege finding class.
Docker group membership is not limited to listing container names. It does not prove AppArmor is enforcing MAC for all processes. It is not equivalent to read-only SNMP community access and should not be scored informational by default.
Exam caveat: rootless docker and hardened socket proxies change the model—verify the actual privilege of the socket and engine configuration.
Operational check: confirm group membership and socket permissions, describe host-equivalent risk without running destructive breakout on production without approval, and recommend removing interactive users from docker group on city servers. In municipal operations, record the rationale in the engagement notes so future assessors know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same finding class still applies under the estate's current patch and configuration baseline.