A security analyst is investigating an unauthorized Docker container running on a company's production server. Upon further analysis, they discover that an attacker exploited misconfigured Docker settings to execute commands with root privileges on the host system. The attacker was able to run arbitrary containers without authentication. Which component was most likely compromised?