Container escapes are becoming one of the most overlooked attack paths in cloud environments. We keep hardening clusters, tuning IAM, scanning images… but very few people are actually watching for the signals that someone is trying to break out of a container.
If an attacker pops a shell inside a container, their very next move is to look for ways to escape into the host. And unless you’re using the right detection layers, most escape attempts leave almost no noise.
Here are the most reliable ways to catch container escape attempts before they turn into a full host compromise:
1. AppArmor (Ubuntu / Debian ecosystems)
Docker automatically applies the docker-default AppArmor profile unless you override it.
If someone tries to:
-
mount host disks
-
modify
/proc/sysrq-trigger -
load kernel modules
-
write to sensitive paths
…you’ll see AppArmor denials that look like:
DENIED mount /dev/sda1 (cap_sys_admin)
2. SELinux (RHEL / Fedora / Podman environments)
SELinux labels everything: processes, files, sockets, the works.
Escape attempts generate AVC denials like:
avc: denied { write } for pid=291 path="/sys/fs/cgroup/release_agent"
If you ever see anything touching release_agent, stop what you're doing.
This is one of the classic container escape vectors (including in CVE-2022-0492).
3. Seccomp (Docker’s syscall firewall)
Docker’s default Seccomp profile blocks dangerous syscalls such as:
-
unshare() -
mount() -
ptrace()
If an attacker tests these syscalls and gets blocked, you’ll see logs like:
seccomp: syscall unshare() blocked
These syscalls usually appear only when someone’s trying to escalate or escape.
4. Falco (Behavior-based runtime detection)
Falco is the easiest way to detect container escapes in real time.
One of the most powerful rules:
Detect release_agent File Container Escapes
It alerts whenever a container process attempts to write to release_agent — a classic cgroup escape method.
Falco also catches:
-
attempts to mount host filesystems
-
usage of nsenter to jump into host namespaces
-
modification of block devices
-
suspicious writes inside
/proc/<PID>/rootpaths
Most escape attempts generate multiple Falco hits before the attacker succeeds.
The Dockers Security & Pentesting book goes into:
✔ dozens of real escape techniques
✔ step-by-step exploitation guides
✔ detection logic
✔ reverse engineering of Docker images
✔ Docker registry attacks
✔ cloud container exploitation (AWS ECR, remote builders)
✔ Docker forensics and runtime analysis
✔ advanced privilege escalation using capabilities
✔ and misconfigurations that lead to total host compromise
…all backed by practical examples and real PoCs.
If you want to master this domain, this is the resource you need.
Download the book from here
0 comments