offensive-container-escape

1# Container Escape and Breakout
2 
3You have a shell inside a container. Your objective is to break out to the underlying host operating system. Container isolation relies on Linux namespaces, cgroups, seccomp profiles, AppArmor/SELinux, and dropped capabilities. Every misconfiguration in these layers is an escape vector. This skill walks you through systematic enumeration, exploitation of common misconfigurations, abuse of exposed runtime sockets, capability-based escapes, cgroup breakouts, and known CVEs against container runtimes.
4 
5## Quick Workflow
6 
71. Confirm you are inside a container (check for `.dockerenv`, cgroup entries, PID 1 process).
82. Enumerate capabilities, mounts, namespaces, and sockets with automated tools.
93. Identify the escape vector: privileged mode, socket exposure, dangerous capabilities, cgroup misconfiguration, or vulnerable runtime.
104. Execute the breakout technique matching the vector.
115. Validate host access by reading `/etc/hostname`, checking PID namespace, or writing to host filesystem.
126. Pivot from host access to lateral movement across the cluster or infrastructure.
13 
14---
15 
16## Phase 1: Container Detection and Enumeration
17 
18Before attempting escape, confirm you are containerized and map the attack surface.
19 
20### Detecting Container Environment
21 
22```bash
23# Check for Docker marker file
24ls -la /.dockerenv
25 
26# Check cgroup entries for container identifiers
27cat /proc/1/cgroup | grep -E 'docker|containerd|kubepods|podman'
28…