Docker Sandboxes: read-only host mounts stay writable at their virtio-fs shared-export path

Impact

The read-only intent of a runtime host mount is applied only to the in-guest container bind. The underlying virtio-fs host-edge grant is added to the sandbox's policy-share allowlist with no access mode, so the directory remains writable at its shared-export path. Unprivileged code inside the sandbox can derive that path and write to a host directory the operator deliberately attached read-only. Where sandboxes are used to run untrusted agent or model code against datasets, model weights or configuration on a GPU host, an attacker can poison exactly the artifacts the read-only flag was meant to protect, and every other consumer of that directory on the host sees the modified content. The record scores integrity impact only, with no confidentiality or availability loss.

Who can reach it

Any unprivileged process running inside a Docker Sandbox that was given a read-only host mount. Local, low privileges, no user interaction; the vector notes an attack requirement (AT:P) that must be present.

What to do

The record carries no fixed version — its references are Docker Sandboxes product documentation, not an advisory with a version. Until Docker names a fix, do not attach host directories whose integrity you depend on to sandboxes running untrusted code; hand them a copy, or place the data on a path the sandbox has no grant for. Watch for a Docker Desktop / sandbox runtime update.

References