Profile My skills Saved My plugins Edit profile Submit a skill

Performing Container Escape Detection

Detects container escape attempts by analyzing namespace configurations, privileged container checks, dangerous capability assignments, and host path mounts using the kubernetes Python client. Identifies CVE-2022-0492 style escapes via cgroup abuse. Use when auditing container security posture or investigating escape attempts.

autohandai Updated
DevOps & Infra

File contents

Performing Container Escape Detection

Instructions

Audit Kubernetes pods for container escape vectors including privileged mode, dangerous capabilities, host namespace sharing, and writable hostPath mounts.

from kubernetes import client, config
config.load_kube_config()
v1 = client.CoreV1Api()

pods = v1.list_pod_for_all_namespaces()
for pod in pods.items:
    for container in pod.spec.containers:
        sc = container.security_context
        if sc and sc.privileged:
            print(f"PRIVILEGED: {pod.metadata.namespace}/{pod.metadata.name}")

Key escape vectors:

  1. Privileged containers (full host access)
  2. CAP_SYS_ADMIN capability
  3. Host PID/Network/IPC namespace sharing
  4. Writable hostPath mounts to / or /etc
  5. Docker socket mount (/var/run/docker.sock)

Examples

# Check for docker socket mounts
for vol in pod.spec.volumes or []:
    if vol.host_path and "docker.sock" in (vol.host_path.path or ""):
        print(f"Docker socket exposed: {pod.metadata.name}")

autohandai/community-skills/tree/main/performing-container-escape-detection commit 9d6ce88422

Browse category

Frequently asked questions

npx skillmds@latest add autohandai-community-skills/performing-container-escape-detection