thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Advanced

Container Escape

Breaking out of a container's isolation to gain access to the host or other containers.

Definition

Escapes exploit kernel vulnerabilities, container runtime bugs, privileged mode, mounted Docker sockets, dangerous capabilities or host path mounts. Mitigations include patching hosts and runtimes, avoiding privileged settings, seccomp/AppArmor/SELinux, user namespaces, rootless runtimes and sandboxed runtimes like gVisor or Kata Containers.

Example

Mounting /var/run/docker.sock into a container lets a process in it control the host's Docker daemon.

Exam tip

Containers share the host kernel; that is why kernel patching and least privilege matter.

Related terms