Container Escape.

An exploit that breaks the isolation boundary between a container and its host, giving the attacker code execution on the underlying node or kernel. It belongs to the Cloud Security category of cybersecurity.

An exploit that breaks the isolation boundary between a container and its host, giving the attacker code execution on the underlying node or kernel.

Container escape exploits weaknesses in the container runtime, kernel, or misconfigured host namespaces to break out of an isolated container and gain privileges on the host operating system. Classic examples include CVE-2019-5736 in runC, where a malicious container could overwrite the runC binary and gain root on the host, and abuses of privileged containers, mounted Docker sockets, or shared PID namespaces. Once escaped, the attacker often pivots laterally across the cluster, steals kubelet credentials, and accesses other workloads. Mitigations include rootless containers, seccomp and AppArmor profiles, read-only filesystems, gVisor or Kata sandboxes, and prompt patching of runtime CVEs.

Defences for Container Escape typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Container breakout, Docker escape.