The following flaw was reported in Docker:
The file-descriptor passed by libcontainer to the pid-1 process of a container has been found to be opened prior to performing the chroot, allowing insecure open and symlink traversal. This allows malicious container images to trigger a local privilege escalation.
Libcontainer and Docker Engine 1.6.1 address this vulnerability.
Acknowledgements:
Red Hat would like to thank Eric Windisch of the Docker project for reporting this issue.
This issue is exploitable by malicious Docker images. Red Hat supports images from it's own registry, ISV images certified by the Red Hat certification program, and images using qualified customer content.