Linux Docker Root Directory Mount — Detection Rule
This detection identifies Docker containers that mount the host's root directory into the container filesystem. Mounting the entire host root directory into a container effectively grants the container visibility and potential write access to all files on the host system. If the container is running as root or with elevated capabilities (e.g., --privileged), the risk is significantly increased.