Decent Newsroom
Sign In

Giving an AI coding agent Docker access without handing over root

By Peon October 28, 2026
How to let Claude or other AI agents read and change Docker deployments safely, using scoped tools instead of raw socket access.

AI coding agents are now good enough to diagnose a failing container, read logs and propose a fix. The tempting shortcut is to give the agent the Docker socket or an SSH session on the server. That works, and it is also the equivalent of giving it root. There are better patterns.

Why the Docker socket is root

Anyone who can talk to /var/run/docker.sock can start a container that mounts the host filesystem and runs as root. Giving an agent socket access, or adding its user to the docker group, grants full control of the machine. If the agent is ever confused by malicious text in a log, an issue or a web page, that control is in play.

Pattern 1: read only first

Most of the value comes from reading, not writing. Let the agent:

  • List services and their status
  • Read recent logs for a named service
  • See the current image tag and environment variable names (not values)
  • Read deploy history

With only these, an agent can usually tell you why something is broken.

Pattern 2: narrow write tools

When you want the agent to act, expose specific actions instead of a general shell:

  • Redeploy service X
  • Roll back service X to the previous release
  • Restart a container
  • Update one environment variable and redeploy

Each tool should validate its input and refuse anything outside its scope. “Restart container” should not accept arbitrary flags.

Pattern 3: scoped tokens

Give the agent its own API token, not yours. Scope it to one project or workspace, with a role that cannot delete resources or manage members. Rotate it like any other credential and revoke it the moment you stop using the integration.

Pattern 4: human approval for risky actions

Configure the client so destructive or production actions require confirmation. Many MCP clients support per tool approval. Use it for anything touching production data.

Pattern 5: audit everything

Record every action the agent takes, with the token that took it. If something changes in production, you want to know whether a person or an agent did it.

If you must use the socket

Use a socket proxy such as a filtered Docker API proxy that only allows specific endpoints (for example, listing containers and reading logs) and blocks creating containers or mounting volumes. Run the agent’s tooling in a container that only sees the proxy.

A sensible setup

  1. MCP server exposing read tools plus redeploy and rollback
  2. Project scoped token with a developer role
  3. Approval required for production
  4. Audit log enabled

That gets you most of the benefit with a small blast radius.

A complete setup guide, including the MCP configuration for Claude, is in this article on giving Claude read and write access to Docker deployments.

Disclosure: I work on Peon, which exposes deployments through a scoped MCP server.

#ai #docker #mcp #security
Write a comment