Container Breakout & Kubernetes Escape

When to Activate

• You have code execution inside a container/pod and want to break out to the host node
• Auditing a Kubernetes cluster for RBAC privilege-escalation and lateral-movement paths
• Assessing runc/containerd/BuildKit/Docker runtime versions against known escape CVEs
• A pod is privileged, has dangerous capabilities, hostPath/hostPID/hostNetwork, or a mounted docker.sock
• Attacking GPU/AI workloads using the NVIDIA Container Toolkit
• Testing ingress-nginx / admission-controller exposure for unauthenticated RCE
• Post-escape: pivoting from one node to full cluster takeover (kubelet, SA tokens, etcd, cloud IMDS)
• Building Falco/Sigma detections for container-escape behavior (defensive validation)

Technique Map