SENSITIVE_SOCKET_PATHS

Shared event names and public type aliases. See the guide.

zett_agent.sandbox.policy.SENSITIVE_SOCKET_PATHS: tuple[str, ...] = ('/var/run/docker.sock', '/run/docker.sock', '/var/run/podman/podman.sock', '/run/podman/podman.sock')

Container-engine sockets. Connecting to one is the same as being root on the host, and a read-only mount does not stop a connection to a socket file.