diff --git a/examples/modules/modules_test.go b/examples/modules/modules_test.go
index 488acba..fcaca21 100644
--- a/examples/modules/modules_test.go
+++ b/examples/modules/modules_test.go
@@ -546,6 +546,15 @@ func TestEveryMountedPathIsADirectoryTheModuleDeclared(t *testing.T) {
 					continue // a named volume, which the runtime owns and the mesh does not
 				}
 				checked++
+				// A machine facility is not the module's data, and the manifest cannot yet say
+				// so (novox/hq 04-ISSUES/026, reopened on exactly this): the runtime's socket
+				// exists, the machine owns it, and declaring it as the module's directory would
+				// be a lie the host acts on. Named here one by one rather than waved through by
+				// pattern, so each new facility is a deliberate addition beside the issue that
+				// owns the vocabulary.
+				if host == "/var/run/docker.sock" {
+					continue
+				}
 				var covered bool
 				for d := range declared {
 					if host == d || strings.HasPrefix(host, strings.TrimRight(d, "/")+"/") {