Unix Domain Sockets, or .sock files, sit in kernel memory rather than on disk. When two local processes talk, the data skips the heavy TCP/IP stack, cutting latency and eliminating packet headers. That speed is only part of the appeal; the kernel also guarantees the identity of the peer, a feature absent in ordinary TCP.

The trick is the SO_PEERCRED socket option, which hands the server the peer’s PID, UID, and GID straight from the kernel. Docker’s docker.sock uses file permissions to lock the API to the docker group, while SPIRE’s agent calls this option to confirm that a workload truly owns the certificate request. The check also guards against PID‑reuse attacks.

Because UDS delivers both speed and uncompromised identity, it remains the backbone of the last mile in container runtimes and Zero‑Trust architectures. As cloud‑native stacks grow, more services will lean on kernel‑verified sockets instead of exposing HTTP endpoints. Watch how orchestration tools evolve to expose fewer network ports while tightening local access controls.