<!-- mobian-agent-page publisher="dailydev" canonical="https://daily.dev/posts/when-read-only-mounts-in-docker-sandboxes-become-writable-ikkwnaofd" -->

---
title: When read-only mounts in Docker Sandboxes become writable
description: A vulnerability in Docker Sandboxes, tracked as CVE-2026-18171, allowed code running inside a sandbox to bypass read-only directory mounts. Docker Sandboxes...
canonical: https://daily.dev/posts/when-read-only-mounts-in-docker-sandboxes-become-writable-ikkwnaofd
twitter:card: summary_large_image
twitter:site: @dailydotdev
og:type: website
og:site_name: daily.dev
og:title: When read-only mounts in Docker Sandboxes become writable | daily.dev
og:description: A vulnerability in Docker Sandboxes, tracked as CVE-2026-18171, allowed code running inside a sandbox to bypass read-only directory mounts. Docker Sandboxes...
og:url: https://daily.dev/posts/when-read-only-mounts-in-docker-sandboxes-become-writable-ikkwnaofd
og:image: https://api.daily.dev/og/posts/iKkwNaoFD.png
og:image:alt: When read-only mounts in Docker Sandboxes become writable
og:image:width: 1200
og:image:height: 630
og:locale: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# When read-only mounts in Docker Sandboxes become writable

**[Aikido Security](https://daily.dev/sources/aikido-security)** · 5 min read · 2 upvotes · 0 comments

## Summary

A vulnerability in Docker Sandboxes, tracked as CVE-2026-18171, allowed code running inside a sandbox to bypass read-only directory mounts. Docker Sandboxes run coding agents like Claude Code, Codex, or Gemini CLI inside a microVM using VirtioFS to share host files. A directory mounted read-only at one path (e.g. /readonly) was simultaneously exposed writable via Docker's host export at /mnt/host, so a compromised or malicious agent could write to files it should not have been able to touch, such as build scripts or CI configuration. The flaw affected versions 0.35.0 through 0.37.1 on Windows, macOS, and Linux, and is fixed in version 0.38.0. Docker responded quickly after the report on July 27, 2026, shipping a fix and CVE by August 12, 2026.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://www.aikido.dev/blog/read-only-mounts-docker-sandboxes-writable>

## Questions this post answers

### What is CVE-2026-18171 in Docker Sandboxes?

CVE-2026-18171 is a vulnerability in Docker Sandboxes, versions 0.35.0 through 0.37.1, where directories mounted as read-only could still be written to. The sandbox uses VirtioFS to expose host directories twice: once at the read-only mount point and again through a writable export at /mnt/host pointing to the same files, letting code inside the sandbox bypass the read-only restriction. It carries a CVSS score of 5.7 and is fixed in version 0.38.0.

_Teams running AI coding agents in Docker Sandboxes should track fixes like this through daily.dev before an agent exploits a stale version._

### How can code inside a Docker Sandbox bypass a read-only mount?

By writing through the alternate /mnt/host export path instead of the read-only mount point. Docker Sandboxes mounts a host directory read-only at a path such as /readonly, but the same directory is also exposed read-write under /mnt/host via VirtioFS. Running findmnt reveals both mounts, one marked ro and one rw, pointing to identical host files, so writing to the /mnt/host path modifies files the read-only mount was supposed to protect.

_Developers securing AI agent sandboxes can follow daily.dev for writeups like this on mount isolation flaws._

### Which Docker Sandbox version fixes the read-only mount bypass vulnerability?

Version 0.38.0 fixes the read-only mount bypass tracked as CVE-2026-18171. Versions 0.35.0 through 0.37.1 are vulnerable. Docker Security reproduced the report, planned a fix within two days, and released the fix along with the CVE on August 12, 2026, after the issue was reported on July 27, 2026.

_daily.dev helps developers running Docker Sandboxes stay on top of version fixes like this one._

## Similar posts on daily.dev

- [Docker Sandboxes: A New Approach for Coding Agent Safety](https://daily.dev/posts/docker-sandboxes-a-new-approach-for-coding-agent-safety-vab1yodxc) · Docker · 1 upvotes · 0 comments
- [Docker Compose vulnerability opens door to host-level writes](https://daily.dev/posts/docker-compose-vulnerability-opens-door-to-host-level-writes-bsledwhng) · The Register · 1 upvotes · 0 comments
- [The Questions Every Team Asks About Docker Sandboxes](https://daily.dev/posts/the-questions-every-team-asks-about-docker-sandboxes-dea3ny4vm) · Cloud Native Now · 0 upvotes · 0 comments
- [Docker Sandboxes: Run Claude Code and More Safely](https://daily.dev/posts/docker-sandboxes-run-claude-code-and-more-safely-6ydoupfk7) · Docker · 1 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#docker](https://daily.dev/tags/docker), [#containers](https://daily.dev/tags/containers)

[View this post on daily.dev](https://daily.dev/posts/when-read-only-mounts-in-docker-sandboxes-become-writable-ikkwnaofd)

```json
{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]}
{"@context":"https://schema.org","@type":"TechArticle","headline":"When read-only mounts in Docker Sandboxes become writable","url":"https://daily.dev/posts/when-read-only-mounts-in-docker-sandboxes-become-writable-ikkwnaofd","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/when-read-only-mounts-in-docker-sandboxes-become-writable-ikkwnaofd"},"datePublished":"2026-08-13T17:44:15.267Z","dateModified":"2026-09-14T07:42:35.630Z","description":"A vulnerability in Docker Sandboxes, tracked as CVE-2026-18171, allowed code running inside a sandbox to bypass read-only directory mounts. Docker Sandboxes...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/12b98fff30c86d14d78d5ffd4af935c2?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/12b98fff30c86d14d78d5ffd4af935c2?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Aikido Security","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Aikido Security","logo":"https://media.daily.dev/image/upload/s--vJDqDYv_--/f_auto,q_auto/v1774959928/logos/aikido-security?_a=BAMAMiWQ0","url":"https://daily.dev/sources/aikido-security"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/when-read-only-mounts-in-docker-sandboxes-become-writable-ikkwnaofd","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,docker,containers","timeRequired":"PT5M"}
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Aikido Security","item":"https://daily.dev/sources/aikido-security"},{"@type":"ListItem","position":3,"name":"When read-only mounts in Docker Sandboxes become writable"}]}
{"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/when-read-only-mounts-in-docker-sandboxes-become-writable-ikkwnaofd#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-18171 in Docker Sandboxes?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-18171 is a vulnerability in Docker Sandboxes, versions 0.35.0 through 0.37.1, where directories mounted as read-only could still be written to. The sandbox uses VirtioFS to expose host directories twice: once at the read-only mount point and again through a writable export at /mnt/host pointing to the same files, letting code inside the sandbox bypass the read-only restriction. It carries a CVSS score of 5.7 and is fixed in version 0.38.0. Teams running AI coding agents in Docker Sandboxes should track fixes like this through daily.dev before an agent exploits a stale version."}},{"@type":"Question","name":"How can code inside a Docker Sandbox bypass a read-only mount?","acceptedAnswer":{"@type":"Answer","text":"By writing through the alternate /mnt/host export path instead of the read-only mount point. Docker Sandboxes mounts a host directory read-only at a path such as /readonly, but the same directory is also exposed read-write under /mnt/host via VirtioFS. Running findmnt reveals both mounts, one marked ro and one rw, pointing to identical host files, so writing to the /mnt/host path modifies files the read-only mount was supposed to protect. Developers securing AI agent sandboxes can follow daily.dev for writeups like this on mount isolation flaws."}},{"@type":"Question","name":"Which Docker Sandbox version fixes the read-only mount bypass vulnerability?","acceptedAnswer":{"@type":"Answer","text":"Version 0.38.0 fixes the read-only mount bypass tracked as CVE-2026-18171. Versions 0.35.0 through 0.37.1 are vulnerable. Docker Security reproduced the report, planned a fix within two days, and released the fix along with the CVE on August 12, 2026, after the issue was reported on July 27, 2026. daily.dev helps developers running Docker Sandboxes stay on top of version fixes like this one."}}]}
```