Container Escape

CriticalDevOps SecurityOWASP Docker Security / Kubernetes Top 10

Attackers exploit misconfigured containers, kernel vulnerabilities, or privileged container settings to break out of container isolation and gain access to the host operating system, other containers, or the underlying infrastructure.

Immediate Response

1Isolate the affected container and host node from the cluster immediately.
2Remove privileged flags, host mounts, and exposed runtime sockets from the container configuration.
3Capture forensic evidence from the host and container before remediation.
4Rotate all credentials and secrets accessible from the compromised container.

All playbooks

1Enforce non-root container execution and drop all unnecessary Linux capabilities.
2Apply seccomp profiles and AppArmor/SELinux policies to restrict container syscalls.
3Use read-only root filesystems and avoid hostPath volume mounts.
4Patch container runtimes and host kernels to address known escape vulnerabilities.

Long-term Prevention

1Deploy admission controllers (OPA Gatekeeper, Kyverno) to block privileged container deployments.
2Implement runtime security monitoring with Falco or Sysdig for container escape detection.
3Use gVisor or Kata Containers for high-risk workloads requiring stronger isolation.
4Conduct regular container penetration tests and kernel vulnerability assessments.

Attack vectors

Privileged containers with host PID, network, or filesystem access
Kernel exploits (e.g., CVE-2022-0185, CVE-2024-21626) enabling container breakout
Writable hostPath volume mounts exposing the host filesystem
Exposed Docker socket or container runtime API allowing host command execution

Indicators of compromise

Processes on the host system spawned from within container contexts
Container audit logs showing access to host namespaces or privileged capabilities
Unexpected host filesystem modifications originating from container workloads
Network connections from containers to the host management API or Docker socket

Tooling

FalcoSysdigkube-hunterCDK (Container Detection Kit)Tracee