A Practitioner's Primer on Container Escapes

[SEED CONTENT — replace] This article is placeholder copy seeded to exercise the layout. Swap it for a real write-up before launch.

A container escape rarely needs a kernel zero-day. Most real-world escapes exploit a misconfiguration that someone shipped for convenience — a mounted Docker socket, an overly broad capability set, or a privileged flag left on from local debugging.

The Docker socket mount

If /var/run/docker.sock is mounted inside a container, anything running in that container can talk to the host's Docker daemon directly:

# From inside a container with the socket mounted
docker -H unix:///var/run/docker.sock run -v /:/host -it alpine chroot /host sh

That single command spins up a new container with the host's root filesystem mounted, then chroots into it — full host access, no exploit required.

Excess capabilities

CAP_SYS_ADMIN alone is close to a root-equivalent capability inside a container. Combined with certain mount namespace configurations, it enables mounting the host's cgroup filesystem and abusing the release_agent file to execute commands on the host.

• Audit every container's capability set — --cap-add should be an exception, not a default.
• Treat privileged: true in a Kubernetes pod spec as equivalent to handing out root on the node.
• hostPID, hostNetwork, and hostPath mounts to sensitive paths deserve the same scrutiny as an excess capability.

Defense priorities, in order

1. Remove the Docker socket mount unless the workload is genuinely a CI runner that needs it.
2. Run containers with a read-only root filesystem where the application allows it.
3. Apply a restrictive seccomp and AppArmor/SELinux profile instead of relying on defaults.
4. Use Pod Security Admission (or an equivalent policy engine) to reject privileged pods before they schedule.

Container escapes are usually a configuration audit finding waiting to be discovered — the fix is almost always cheaper than the incident.