Senior LevelWeb Security & Cyber Defense
How do attackers execute Container Escapes via exposed Docker Sockets or unprivileged mounts?
❓ Interview Prompt: Explain Container Escape vectors, mounting `/var/run/docker.sock`, privileged containers (`--privileged`), Linux namespaces, cgroups, and seccomp profiles.
A Container Escape allows an attacker inside a container to break out and gain root access to the host operating system:
Exposed Docker Socket Breakout:
If a container mounts '/var/run/docker.sock':
•
The attacker inside the container uses 'docker' CLI or HTTP socket API to launch a new host container with '--privileged -v /:/host'.
•
The attacker chroots into '/host', gaining total root access to the host OS!
•
Defense: Never mount the Docker socket, drop Linux capabilities ('--drop ALL'), and enforce strict 'seccomp' profiles.
Code Implementation Example
bash
# Exploit exposed docker.sock to escape to host root shell:
docker -H unix:///var/run/docker.sock run -it --privileged -v /:/host alpine chroot /host /bin/bash💡Exploiting exposed docker.sock to gain host root shell access.
🎯 Interview Key Takeaway
Never mount /var/run/docker.sock inside containers and enforce seccomp and AppArmor profiles to prevent container escapes.
#Container Escape#Docker Security#Kubernetes#Senior
Back to all Web Security & Cyber Defense Questions→