[SEED CONTENT — replace] This article is placeholder copy seeded to exercise the layout. Swap it for a real write-up before launch.
A container escape rarely needs a kernel zero-day. Most real-world escapes exploit a misconfiguration that someone shipped for convenience — a mounted Docker socket, an overly broad capability set, or a privileged flag left on from local debugging.
The Docker socket mount
If `/var/run/docker.sock` is mounted inside a container, anything running in that container can talk to the host's Docker daemon directly:
# From inside a container with the socket mounted
docker -H unix:///var/run/docker.sock run -v /:/host -it alpine chroot /host sh
That single command spins up a new container with the *host's root filesystem* mounted, then chroots into it — full host access, no exploit required.
Excess capabilities
`CAP_SYS_ADMIN` alone is close to a root-equivalent capability inside a container. Combined with certain mount namespace configurations, it enables mounting the host's cgroup filesystem and abusing the `release_agent` file to execute commands on the host.
- Audit every container's capability set — `--cap-add` should be an exception, not a default.
- Treat `privileged: true` in a Kubernetes pod spec as equivalent to handing out root on the node.
- `hostPID`, `hostNetwork`, and `hostPath` mounts to sensitive paths deserve the same scrutiny as an excess capability.
Defense priorities, in order
- Remove the Docker socket mount unless the workload is genuinely a CI runner that needs it.
- Run containers with a read-only root filesystem where the application allows it.
- Apply a restrictive seccomp and AppArmor/SELinux profile instead of relying on defaults.
- Use Pod Security Admission (or an equivalent policy engine) to reject privileged pods before they schedule.
Container escapes are usually a configuration audit finding waiting to be discovered — the fix is almost always cheaper than the incident.