I have have sent several emails about this issue to security@docker.com without receiving a reply (the earliest being 3 months ago), so I'm opening the issue here.

There is a vulnerability that allows anyone on the same network as a docker host to access containers running on that host, regardless of exposed ports.

When docker starts, it enables net.ipv4.ip_forward without changing the iptables FORWARD chain default policy to DROP. This means that another machine on the same network as the docker host can add a route to their routing table, and directly address any containers running on that docker host.

For example, if the docker0 subnet is 172.17.0.0/16 (the default subnet), and the docker host's IP address is 192.168.0.10, from another host on the network run:

ip route add 172.17.0.0/16 via 192.168.0.10
nmap 172.17.0.0/16

The above will scan for containers running on the host, and report IP addresses & running services found.

To fix this, docker needs to set the FORWARD policy to DROP when it enables the net.ipv4.ip_forward sysctl parameter.

This issue is verified still present in docker 1.7.0

See also #11508.