The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling bluetooth or turning up/down keyboard brightness.
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "docker-doc": "18.06.1-0ubuntu1~16.04.2", "docker.io": "18.06.1-0ubuntu1~16.04.2", "golang-github-docker-docker-dev": "18.06.1-0ubuntu1~16.04.2", "golang-docker-dev": "18.06.1-0ubuntu1~16.04.2", "vim-syntax-docker": "18.06.1-0ubuntu1~16.04.2" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "docker-doc": "18.06.1-0ubuntu1~18.04.1", "docker.io": "18.06.1-0ubuntu1~18.04.1", "golang-github-docker-docker-dev": "18.06.1-0ubuntu1~18.04.1", "golang-docker-dev": "18.06.1-0ubuntu1~18.04.1", "vim-syntax-docker": "18.06.1-0ubuntu1~18.04.1" } ] }