Container escape vulnerability
A security flaw that allows a process confined within a container to access the host or other resources outside the container.
Cyber Threat Hunting
An adversary technique in which an attacker escapes a container to execute actions on the underlying host.
- How it is used
- Detects possible container-to-cluster movement through Kubernetes API-server auditing and runtime alerts.
- How deep it goes
- Works through baselining, event searches, account checks, runtime rules, and alert evidence without detailing an exploit mechanism.
- Examples
- Uses a privileged portal deployment, anomalous API callers, in-container kubectl, Falco events, and suspicious workload pods.
- What you can do after
- Diagnose/debug with it by baselining API callers and correlating anomalous audit events with container runtime alerts.
Read how Cyber Threat Hunting explains container escape vulnerability →
Kubernetes for Developers
A container escape vulnerability is a flaw that allows a process confined in a container to access resources or privileges outside the container.
- How it is used
- Frames container security around limiting node impact when container isolation is breached.
- How deep it goes
- Explains privilege inheritance, non-root mitigation, runtime isolation, and deployment failures without detailing escape exploits.
- Examples
- Uses a Kubernetes timeserver deployment, permission errors, port changes, and a non-root Dockerfile.
- What you can do after
- Apply it via Kubernetes securityContext and RuntimeClass settings to reduce node compromise from escaped containers.
Read how Kubernetes for Developers explains container escape vulnerability →
Related concepts
- containeruses · A software container is an isolated execution environment that packages an application and its dependencies while sharing the host operating system kernel.
- MITRE ATT&CKpart of · MITRE ATT&CK is a publicly maintained knowledge base and framework cataloging adversary tactics, techniques, and procedures based on observed cyberattacks.
- type enforcementaddressed by · Type enforcement is an SELinux access-control technique that restricts interactions according to the security types assigned to processes and resources.
- SELinuxaddressed by · SELinux is a Linux security framework that enforces mandatory access-control policies on processes and resources.
- rootless modeaddressed by · Rootless mode is a container-execution mode in which the container engine and processes run without host-level root privileges.
- seccompaddressed by · seccomp is a Linux kernel security facility that restricts the system calls a process and optionally its descendants may invoke.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.