Offensive Container Escape
Container escape and breakout techniques targeting Docker, containerd, and Podman...
Install
npx skills add SnailSploit/Claude-Red --skill offensive-container-escape -g -a claude-code -y- Repository
- SnailSploit/Claude-Red10.2k
- Category
- Security
- Updated
- 23d ago
- License
- MIT
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Container escape and breakout techniques targeting Docker, containerd, and Podman runtimes. Covers privileged container breakout via host filesystem mount and nsenter, Docker socket abuse through /var/run/docker.sock, Linux capability exploitation including CAP_SYS_ADMIN, CAP_SYS_PTRACE, and CAP_NET_ADMIN, cgroup v1 notify_on_release escape, runc CVEs such as CVE-2019-5736 and CVE-2024-21626 Leaky Vessels, kernel exploits from within containers, and Dockerfile misconfigurations like --privileged and host namespace sharing. Includes enumeration with capsh, amicontained, deepce, CDK, and nsenter. Maps to MITRE ATT&CK T1611 Escape to Host. Use this skill when the engagement scope includes container breakout, Docker escape, container privilege escalation, host access from container, or when you land inside a containerized environment and need to reach the underlying host.
Container Escape and Breakout
You have a shell inside a container. Your objective is to break out to the underlying host operating system. Container isolation relies on Linux namespaces, cgroups, seccomp profiles, AppArmor/SELinux, and dropped capabilities. Every misconfiguration in these layers is an escape vector. This skill walks you through systematic enumeration, exploitation of common misconfigurations, abuse of exposed runtime sockets, capability-based escapes, cgroup breakouts, and known CVEs against container runtimes.
Quick Workflow
- Confirm you are inside a container (check for
.dockerenv, cgroup entries, PID 1 process). - Enumerate capabilities, mounts, namespaces, and sockets with automated tools.
- Identify the escape vector: privileged mode, socket exposure, dangerous capabilities, cgroup misconfiguration, or vulnerable runtime.
- Execute the breakout technique matching the vector.
- Validate host access by reading
/etc/hostname, checking PID namespace, or writing to host filesystem. - Pivot from host access to lateral movement across the cluster or infrastructure.
Phase 1: Container Detection and Enumeration
Before attempting escape, confirm you are containerized and map the attack surface.
Detecting Container Environment
# Check for Docker marker file
ls -la /.dockerenv
# Check cgroup entries for container identifiers
cat /proc/1/cgroup | grep -E 'docker|containerd|kubepods|podman'
# Check PID 1 process (containers typically run app process, not init)
cat /proc/1/cmdline | tr '\0' ' '
# Check for container-specific environment variables
env | grep -iE 'kubernetes|docker|container|pod'
# Check hostname (often a truncated container ID)
hostname
# Check mount info for overlay filesystem
cat /proc/1/mountinfo | head -20
