The daemon socket is the whole machine

Mounting /var/run/docker.sock into a container to let it build images is equivalent to giving that container root on the host, and it is presented in most CI documentation as a normal thing to do.

# what "access to the socket" actually permits:
$ docker run -v /:/host -it alpine chroot /host sh
# you are now root on the host. no escape needed.

# the alternatives, in order of preference:
#   a build service that is not the runtime daemon
#   rootless mode for the builder
#   accept it, and make sure nothing untrusted runs in that pipeline

There is no permission model on the socket — it is all or nothing, and every socket-mounting container is fully privileged whether or not anybody has said so. Naming it out loud during a CI design is worth the awkwardness, because the usual response is to shrug and move on, and that is a decision rather than an oversight only if somebody made it. The practical mitigation on a small team is to make sure the pipeline with socket access never runs code from a fork.