A teammate mounted the Docker socket into a web app container

You discover a container running a public-facing API has `-v /var/run/docker.sock:/var/run/docker.sock`. Explain the risk and your remediation. Expected reasoning: this gives the container root-equivalent control of the host — any RCE in the app becomes a host compromise. Remediation: remove the mount; if Docker-control-from-a-container is genuinely required (e.g., a CI orchestrator), isolate it on a dedicated host/network, use a Docker socket proxy that whitelists API endpoints, or move to a rootless/Sysbox-based setup.