I feel like I read the exact same story (Person discovers docker group is effectively root because llm agent used it to circumvent not having sudo) a few minths ago. (Not saying you stole it, two people can have the same experience independently of each other. I just found it interesting that this is, apperently, such a commonly overlooked issue.)

Also, this is documented:

Running containers (and applications) with Docker implies running the Docker daemon. This daemon requires root privileges unless you opt-in to Rootless mode, and you should therefore be aware of some important details.

First of all, only trusted users should be allowed to control your Docker daemon. This is a direct consequence of some powerful Docker features. Specifically, Docker allows you to share a directory between the Docker host and a guest container; and it allows you to do so without limiting the access rights of the container. This means that you can start a container where the /host directory is the / directory on your host; and the container can alter your host filesystem without any restriction. This is similar to how virtualization systems allow filesystem resource sharing. Nothing prevents you from sharing your root filesystem (or even your root block device) with a virtual machine.

https://docs.docker.com/engine/security/#docker-daemon-attack-surface