container-overview

name	container-overview
description	Container / Kubernetes attack category — pod escape, RBAC abuse, runtime CVE exploitation, socket-mount escape. Routing skill: identify the surface (pod-internal RCE vs API-level vs build-pipeline), then load the matching sub-skill.
allowed-tools	Bash Read Write
metadata	{"when_to_use":"container kubernetes k8s docker podman containerd cri-o pod rbac runtime escape supply chain image registry helm","subdomain":"cloud-native","tags":"kubernetes, container, cloud-native","mitre_attack":"T1611, T1078.004, T1190"}

Container / Kubernetes Attack Category

This is a routing skill for cloud-native engagements. Identify the surface, then load the matching sub-skill.

Sub-skills

Sub-skill	Covers	When to load
k8s-pod-escape	Privileged container, hostPath escape, hostPID + SYS_PTRACE, runC CVE chains, cgroup release agent	RCE inside a pod, goal is node compromise
k8s-rbac-abuse	auth can-i --list, pods/exec on privileged pods, secrets get/list, escalate verb, bind verb, impersonate, nodes/proxy	You have a ServiceAccount token; goal is cluster-admin
docker-socket-mount	/var/run/docker.sock or containerd socket mounted in → instant host root