Container escape playbook. Use when operating inside a Docker container, LXC, or Kubernetes pod and need to escape to the host via privileged mode, capabilities, Docker socket, cgroup abuse, namespace tricks, or runtime vulnerabilities.

SKILL: Container Escape Techniques — Expert Attack Playbook AI LOAD INSTRUCTION : Expert container escape techniques. Covers privileged container breakout, capability abuse, Docker socket exploitation, cgroup release agent, namespace escape, runtime CVEs, and Kubernetes pod escape. Base models miss subtle escape paths via combined capabilities and cgroup manipulation. 0. RELATED ROUTING Before going deep, consider loading: [linux privilege escalation](../linux privilege escalation/SKILL.md) when you first need root inside the container before attempting escape [kubernetes pentesting](../kubernetes pentesting/SKILL.md) for K8s specific attack paths beyond pod escape [linux security bypass](../linux security bypass/SKILL.md) when seccomp/AppArmor blocks your escape technique Advanced Reference Also load [DOCKER ESCAPE CHAINS.md](./DOCKER ESCAPE CHAINS.md) when you need: Step by step escape chains for common misconfigurations Docker in Docker escape scenarios Kubernetes specific escape paths with full command sequences 1. AM I IN A CONTAINER? Tools for Container Detection 2. PRIVILEGED CONTAINER ESCAPE If privileged flag was used, the container has nearly all host capabilities and device access. 2.1 Mount Host Filesystem 2.2 nsenter (Enter Host Namespaces) 2.3 Privileged + Host PID Namespace 3. CAPABILITY BASED ESCAPE 3.1 CAP SYS ADMIN — Most Versatile 3.2 CAP SYS PTRACE — Process Injection 3.3 CAP NET ADMIN 3.4 CAP DAC READ SEARCH (Shocker Exploit) 4. DOCKER SOCKET ESCAPE (/var/run/docker.sock) 5. CGROUP V1 RELEASE AGENT ESCAPE Classic escape for containers with CAP SYS ADMIN + cgroup v1. 6. CGROUP V2 / eBPF ESCAPE 7. NAMESPACE ESCAPE User Namespace PID Namespace Escape 8. RUNTIME VULNERABILITIES runc CVE 2019 5736 Overwrites host runc binary when docker exec is used. containerd CVE 2020 15257 cgroups CVE 2022 0492 9. KUBERNETES POD ESCAPE Dangerous Pod Spec Escape hostPID: true nsenter t 1 m u i n p bash hostNetwork: true Access node services (Kubelet, etcd) directly hostPath: {path: /} chroot /host bash privileged: true Mount host disk / nsenter SA token with RBAC Create new privileged pod via API See [kubernetes pentesting](../kubernetes pentesting/SKILL.md) for full K8s attack paths. 10. TOOLS Tool Purpose URL/Command deepce Docker enumeration + exploit suggestions ./deepce.sh CDK Container/K8s exploitation toolkit ./cdk evaluate amicontained Show container runtime, caps, seccomp ./amicontained PEIRATES Kubernetes penetration testing ./peirates BOtB Break out the Box — auto escape ./botb autopwn 11. CONTAINER ESCAPE DECISION TREE

container-escape-techniques