Container Escape and Breakout

You have a shell inside a container. Your objective is to break out to the underlying host operating system. Container isolation relies on Linux namespaces, cgroups, seccomp profiles, AppArmor/SELinux, and dropped capabilities. Every misconfiguration in these layers is an escape vector. This skill walks you through systematic enumeration, exploitation of common misconfigurations, abuse of exposed runtime sockets, capability-based escapes, cgroup breakouts, and known CVEs against container runtimes.

Quick Workflow

1. Confirm you are inside a container (check for .dockerenv, cgroup entries, PID 1 process).
2. Enumerate capabilities, mounts, namespaces, and sockets with automated tools.
3. Identify the escape vector: privileged mode, socket exposure, dangerous capabilities, cgroup misconfiguration, or vulnerable runtime.
4. Execute the breakout technique matching the vector.
5. Validate host access by reading /etc/hostname, checking PID namespace, or writing to host filesystem.
6. Pivot from host access to lateral movement across the cluster or infrastructure.

Phase 1: Container Detection and Enumeration

Before attempting escape, confirm you are containerized and map the attack surface.