Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a symlink attack in an image.

Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timerstats, (3) /proc/latencystats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a crafted image.

Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules (LSM) and dockert policies via an image that allows volumes to override files in /proc.