Still the most common ways without exploitation to get root docker containers is bad mounts (-v /:/mnt), running with privileged flag, excessive capabilities (--cap-add=SYS_ADMIN this is basically root) and mounting the socket (-v /var/run/docker.sock:/var/run/docker.sock )
