Container escape → host

When it applies

You have code execution inside a container and want the underlying host (and from there, other containers / the cluster / cloud creds).

Why it works

Containers are isolation by configuration, not a hard boundary. Privileged mode, extra capabilities, mounted host resources, or an exposed Docker socket give processes inside the container direct control over the host kernel/daemon.