The Docker group is root access, my agent used it to write to /etc.
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
A developer writes that for about ten years they ran Docker with their user in the docker group, which lets any process running as that user mount the host root filesystem and write as root.