competition-kernel-container-escape

1# Competition Kernel Container Escape
2 
3Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
4 
5Use this skill when the decisive step is proving a boundary crossing between containerized context and host or higher-privilege kernel context.
6 
7Reply in Simplified Chinese unless the user explicitly requests English.
8 
9## Quick Start
10 
111. Map runtime isolation first: namespaces, cgroups, seccomp, capabilities, LSM, and mount boundaries.
122. Separate exploit prerequisite, primitive, and boundary-crossing proof.
133. Record kernel version, config hints, runtime options, and reachable syscall surface.
144. Keep instrumented observations separate from pristine challenge path.
155. Reproduce one minimal primitive-to-boundary-crossing chain.
16 
17## Workflow
18 
19### 1. Map Isolation And Kernel Surface
20 
21- Record namespace map, cgroup mode, capabilities, seccomp profile, AppArmor or SELinux state, mounted filesystems, and runtime sockets.
22- Note kernel version, distro build hints, module exposure, and container runtime behavior.
23- Keep host and container observations linked to exact node and context.
24 
25### 2. Prove Exploit Primitive And Crossover
26 
27- Show controllable input, trigger condition, affected object, and observable kernel or runtime state change.
28…