← All walkthroughs

Container escape to the host

A container that is over-privileged — a mounted Docker socket, host namespaces or dangerous capabilities — becomes a path out of the container and onto the node itself.

Docker / container host Advanced ContainerPrivilege EscalationHost
Authorized testing only. This is a conceptual, defensive-aware walkthrough that maps an attack path to MITRE ATT&CK, detection and mitigation, and links to references for the detail. It is not a copy-paste playbook. Use it only against systems you own or are explicitly permitted to test.

Scenario

An authorized assessment where you already have code execution inside a container (for example via an exploited app). The objective is to show whether the container's configuration allows escape to the underlying host.

Practice this path: Containers & Kubernetes · MITRE ATT&CK
  1. 1

    Discovery

    Inventory the container's privileges

    T1613 Container and Resource Discovery

    Enumerate the container: capabilities, whether it is privileged, which host paths or sockets are mounted (notably the Docker socket), and shared host namespaces — these determine whether escape is even possible.

    Detection

    Reads of capability/cgroup/mount information and probing of /var/run inside a container can be captured by runtime security tooling.

    Mitigation

    Drop all capabilities by default, never run privileged containers, and never mount the Docker socket into a workload.

    References docker-security · kubernetes-pentest
  2. 2

    Credential Access

    Collect mounted secrets

    T1552.001 Unsecured Credentials: Credentials In Files

    Check mounted volumes, environment variables and service-account tokens reachable from the container for credentials that widen access, documenting each exposure.

    Detection

    Access to token files and secret mounts from an unexpected process is visible to runtime monitoring.

    Mitigation

    Mount only the secrets a workload needs, use short-lived tokens, and keep secrets out of environment variables.

    References docker-security
  3. 3

    Privilege Escalation

    Escape to the host

    T1611 Escape to Host

    Where the configuration allows it — a mounted Docker socket, a privileged container, or dangerous capabilities — demonstrate breaking out to execute in the host context, reporting the specific misconfiguration that permitted it rather than a generic exploit.

    Detection

    A container process gaining host context, new host processes parented to the runtime, and socket-driven container creation are high-fidelity signals.

    Mitigation

    Enforce a restrictive seccomp/AppArmor profile, run as non-root with no-new-privileges, and use user namespaces so container root is not host root.

    References docker-security · kubernetes-pentest
  4. 4

    Discovery / Lateral Movement

    Leverage the host

    T1610 Deploy ContainerT1046 Network Service Discovery

    From the host, show what the node exposes — other containers, the orchestrator, and reachable networks — to map how a single workload compromise becomes node or cluster exposure, staying within scope.

    Detection

    Deploying new containers, and host-level network discovery, are strong post-escape signals in audit and runtime logs.

    Mitigation

    Segment nodes, restrict the orchestrator API, and apply least-privilege to the node's own identity.

    References kubernetes-pentest · pivoting-tunneling · Nmap Command Builder

Key takeaways

  • Container escape is almost always a configuration gift — a mounted socket, privileged mode, or a dangerous capability.
  • Non-root, no-new-privileges, dropped capabilities and user namespaces turn a breakout into a dead end.
  • Treat the Docker socket as root on the host: never hand it to a workload.