Docker Privilege Escalation Skill

Docker container escape and privilege escalation — Docker socket abuse, volume mount host takeover, docker group root-equivalence, and prior-privilege-escalation detection. Docker group membership = instant root on the host via 5 distinct techniques. Confirmed on fitness-chain (Docker containers extracted, 12 image layers, privileged mode) and gov-finance-portal (Dockerfile + docker-compose.prod.yml exposed in GitLab).

When to Use

• You have shell access to a Docker container (via webshell, SSH, or API exploit).
• id shows you're in the docker group or have access to /var/run/docker.sock.
• docker ps or docker info works from within the container.
• After api-noauth-hunt or wordpress-full-compromise achieves RCE in a container.
• Docker socket is mounted at /var/run/docker.sock (check: ls -la /var/run/docker.sock).

Prerequisites

• Shell access inside a Docker container (any user).
• Docker socket mounted OR docker group membership OR --privileged flag.
• Target: escalate to host root.

How to Run