| name | cloud-container-escape |
| description | Break out of a container to the host. Load when you have a shell in a container/pod and want the node: privileged container, mounted docker.sock, dangerous capabilities, hostPath, or "escape the container". Signals: /.dockerenv, cgroup shows docker/k8s, CAP_SYS_ADMIN, mounted socket.
|
| domain | cloud |
| type | technique |
| stability | learning |
| modes | ["pentest","bugbounty"] |
| severity | critical |
| cwe | ["CWE-269"] |
| mitre | ["T1611"] |
| tools | ["amicontained","deepce"] |
| schema_version | 1 |
Container escape → host
When it applies
You have code execution inside a container and want the underlying host (and from there, other
containers / the cluster / cloud creds).
Why it works
Containers are isolation by configuration, not a hard boundary. Privileged mode, extra
capabilities, mounted host resources, or an exposed Docker socket give processes inside the
container direct control over the host kernel/daemon.
Method
- Confirm & enumerate:
/.dockerenv, /proc/1/cgroup; run amicontained/deepce to list
capabilities, seccomp, and mounts.
- Exploit the misconfig:
- Docker socket mounted (
/var/run/docker.sock): docker -H unix://... run -v /:/host ...
→ mount host FS as root → escape.
- Privileged / CAP_SYS_ADMIN: mount the host disk, or use the classic
release_agent
cgroup notify_on_release trick to run a command on the host.
- hostPath / host mounts: write to host filesystem (cron, ssh keys, kubelet config).
- hostPID: access host processes;
nsenter into PID 1's namespaces.
- From the host: grab cloud metadata creds (→
cloud-imds-ssrf), pivot to other
containers/nodes (→ cloud-kubernetes).
Gotchas
- Enumerate capabilities/mounts first — the escape depends entirely on which misconfig exists.
- Kernel-exploit escapes are last-resort and risky on live targets; prefer the config-based paths.
- On bug bounty, a proven mount of the host FS is enough — don't disrupt the node.
Verify success
Command execution or file read/write on the host (outside the container namespace) — e.g. host
/etc/shadow, other containers, or the kubelet/cloud creds.
References
deepce/amicontained; "Understanding Docker container escapes" (Trail of Bits); HackTricks.
