Container Security

Skill: Container Security

Supplementary Files:

• payloads.md — Container security testing attack payloads, categorized by image analysis, escape techniques, Kubernetes security, runtime security, registry security, network policies, secret detection, and privilege escalation
• test-cases.md — 11 structured test cases covering image security, container runtime, Kubernetes, networking, and advanced scenarios

Summary

Container Security skill domain covering cloud operations.

Tools: trivy, docker-bench-security, kubeaudit, falco, clair, grype

Domain: cloud

MITRE ATT&CK: TA0008-Lateral Movement

Description

Container security covers the complete lifecycle from image building, registry management, runtime protection, to orchestration platform (Kubernetes) security. The core objective is to identify configuration flaws, known vulnerabilities, and privilege abuse in container environments, and to verify the effectiveness of container isolation mechanisms.

Mastering this skill requires a deep understanding of Docker architecture (namespaces, cgroups, union filesystem), Kubernetes RBAC and Network Policy, as well as the underlying principles of container escape. The attacker's perspective focuses on breaking out of container isolation from within to obtain host privileges, while the defender's perspective focuses on trusted image signing, least privilege, and runtime monitoring.

Use Cases

1. Container Image Vulnerability Assessment - Scan images for known CVEs, configuration flaws, and hardcoded secrets
2. Container Escape Testing - Verify whether privileged containers, mounted volumes, and kernel vulnerabilities can be exploited to escape to the host
3. Kubernetes Security Audit - Check RBAC configuration, Pod Security Standards, and Network Policies
4. CI/CD Shift-Left Security - Integrate image scanning and security policies into build pipelines
5. Runtime Anomaly Detection - Monitor in-container processes, network connections, and filesystem changes
6. CIS Benchmark Compliance - Evaluate Docker and Kubernetes configurations against CIS security benchmarks

Core Tools

Methodology

Attack Chain

Image Analysis      Registry Security   Runtime Escape     Orchestration      Host Compromise
(trivy scan,      (Unauthenticated    (Privileged       Attack             (Post-escape
 CVE matching)     access, image       container,        (RBAC abuse,       privilege
                    tampering)         kernel vuln)      ServiceAccount)    escalation)
    |               |                  |                |               |
    v               v                  v                v               v
 Credential       Malicious Image     Namespace        Cluster-level     Root Access
 Leakage          Injection           Breakout         Lateral Movement  (Host Control)
 (Env vars,       (Supply chain       (cgroup/ptrace)  (Secret theft)
  hardcoded keys)  attack)

Phase Details:

1. Image Analysis - Scan image layer filesystems to identify known vulnerabilities (CVEs), sensitive file leakage, and improper configurations
2. Registry Security - Detect unauthenticated Docker Registry access, verify image signatures and integrity
3. Runtime Escape - Exploit privileged mode, sensitive path mounts (/var/run/docker.sock), and kernel vulnerabilities to break container isolation
4. Orchestration Platform Attack - Abuse overly permissive RBAC, default ServiceAccount tokens, and unprotected API Servers
5. Host Compromise - Obtain host root privileges from the escaped container, completing lateral movement and persistence

Defense Perspective

• Image Signing - Use cosign/Notary to sign and verify images, preventing supply chain attacks
• Read-Only Filesystem - Set container root filesystem to read-only, limiting attacker write capability
• Network Policy - Use K8s Network Policy to restrict inter-Pod communication, implementing micro-segmentation
• Pod Security Standards - Enforce Restricted/Baseline policies, prohibiting privileged containers
• Runtime Monitoring - Use Falco to detect anomalous processes, sensitive file access, and privilege escalation behavior
• Minimal Base Images - Use distroless or scratch images to reduce attack surface

Practical Steps

1. Image Vulnerability Scanning and Analysis

Use trivy, grype, dockle, and other tools to scan images for CVEs, configuration flaws, and sensitive information leakage.

2. Container Escape Detection and Exploitation

Detect container environment indicators, privileged mode, and sensitive mount points; exploit docker.sock mounts and kernel vulnerabilities for escape.

3. Kubernetes Security Audit

Enumerate RBAC bindings, ServiceAccount permissions, and Secret mounts; use kubeaudit for automated auditing.

4. Runtime Security Monitoring

Check container process capability configurations; use Falco rules to detect shell execution, sensitive file access, and escape behavior.

5. CIS Benchmark Compliance Checks

Use docker-bench-security and kube-bench for Docker/Kubernetes security baseline assessment.

Detailed payloads in payloads.md, complete test checklist in test-cases.md.

Common Pitfalls

• Scanning images without checking runtime configuration: A clean vulnerability scan does not mean a container is secure. A fully patched image running in privileged mode with docker.sock mounted is more dangerous than an outdated image running with least privilege and a read-only filesystem.
• Ignoring ServiceAccount tokens in Kubernetes: Every Pod receives an automatically mounted ServiceAccount token by default. If the ServiceAccount has excessive RBAC permissions, any code running in the Pod (including attacker code after exploitation) inherits those cluster-level privileges.
• Neglecting supply chain verification: Pulling images by tag (e.g., nginx:latest) rather than by digest means the image content can change without notice. An upstream image compromise or tag hijacking can introduce malicious code into your infrastructure without any configuration change on your end.

Automation and Scripting

Automate container security scanning by integrating trivy into CI/CD pipelines to block builds with Critical/High CVEs from being pushed to production registries. Use kubeaudit in scheduled CronJobs to continuously audit Kubernetes RBAC configurations and alert on deviations. Script falco rule testing by generating expected benign and malicious events in a test cluster and verifying that alerts fire correctly. Build custom Python scripts using the Docker SDK to enumerate all running containers and their mount points for rapid privilege escalation surface assessment.

Reporting and Documentation

Container security reports should separate findings by layer: image vulnerabilities (CVE list with CVSS scores), runtime configuration issues (privileged mode, cap-add, sensitive mounts), orchestration misconfigurations (RBAC, Network Policies, Pod Security Standards), and supply chain risks (unsigned images, unverified registries). For each container escape finding, document the escape path from inside the container to host access with specific commands and outputs. Include CIS Benchmark compliance scores as a measurable baseline for tracking improvement over time.

Legal and Ethical Considerations

Container escape testing in shared Kubernetes clusters (multi-tenant environments) carries significant risk of affecting other tenants. Verify that the engagement scope covers escape attempts and coordinate with the cluster operations team to ensure testing occurs in an isolated namespace or during a maintenance window. Container security tools like trivy and kubeaudit are generally safe to run in production for scanning, but active exploitation techniques (escape attempts, privilege escalation) should be performed in dedicated test environments whenever possible.

Integration with Other Tools

Container security findings connect to multiple adjacent skill domains. Image vulnerability results from trivy feed into vulnerability-assessment for CVE tracking and remediation prioritization. Kubernetes RBAC misconfigurations discovered by kubeaudit inform post-exploitation lateral movement planning. Container escape techniques that reach the host transition to host-level post-exploitation methodology. Cloud metadata access from within containers (via SSRF or direct access) connects to cloud-security assessment of the broader infrastructure.

Case Studies and Examples

• docker.sock escape: A web application container had the Docker socket mounted for "log collection." An attacker who gained RCE in the web app used the Docker CLI to create a new privileged container mounting the host's root filesystem, achieving full host compromise in under 60 seconds.
• Kubernetes ServiceAccount escalation: A pod's default ServiceAccount had cluster-admin RBAC bindings due to a misconfigured Helm chart. An attacker who compromised the application used the mounted token to read all Secrets across all namespaces, including database credentials and TLS private keys.
• Supply chain attack via image poisoning: A development team used node:latest as their base image. An upstream compromise of the Node.js Docker image (before it was detected and pulled) would have deployed malicious code to all downstream builds. Shifting to pinned digests and cosign verification prevented this vector.

Detection Methods

Container security detection combines runtime monitoring (Falco, Tetragon), Kubernetes audit logging, image scanning (Trivy, Grype), and cloud-native SIEM integration. Understanding detection patterns helps testers operate more stealthily and helps defenders prioritize monitoring.

Container Runtime Indicators

• Unexpected shell execution: Processes like /bin/sh, /bin/bash spawned inside non-shell containers (web servers, databases); detected by Falco default rules.
• Sensitive file access: Reads of /etc/shadow, /proc/sysrq-trigger, /proc/1/root, host paths mounted via hostPath.
• Anomalous syscalls: ptrace, keyctl, mount, unshare syscalls from inside containers indicate escape attempts.
• Network anomalies: Reverse shells on non-standard ports; Tor / Tor-like traffic; DNS tunneling.
• Capability misuse: CAP_SYS_ADMIN, CAP_DAC_READ_SEARCH, CAP_SYS_PTRACE invoked by non-privileged container processes.

Kubernetes API Server Indicators

• Privileged Pod creation: Pod spec with privileged: true, hostPID: true, hostNetwork: true, hostPath mounts.
• ServiceAccount token abuse: Pods mounting serviceAccountToken not declared in spec; access to /var/run/secrets/kubernetes.io/serviceaccount/token from unexpected processes.
• RBAC escalation: clusterrolebindings.rbac.authorization.k8s.io create/update with subject = user (not service account).
• Anonymous auth: API server with --anonymous-auth=true enabled; requests with no authentication.
• kubectl exec patterns: kubectl exec on system pods (kube-apiserver, etcd); exec on pods in kube-system namespace from non-admin users.

Container Image / Registry Indicators

• Image without digest pinning: Deployments using :latest or unpinned tags; vulnerable to supply chain attack.
• Suspicious base images: Images from unknown registries, recently pushed images (<7 days), images with high CVSS vulnerabilities.
• Cosign / Notation verification failure: Image signature missing or invalid; image verification bypassed via admission controller config.
• Registry compromise: Pulls from compromised public registries (e.g., Docker Hub free tier); anomalous pull volume.

CI/CD Pipeline Indicators

• Build argument injection: CI logs showing unexpected build args; image layers containing secrets not in .dockerignore.
• Cache poisoning: Build cache from untrusted contributor; CI runs with cache-from external source.
• Dependency confusion: Build pulls package from public registry when private package exists; anomalous package install.
• Run-as-root in CI: Build containers running as root instead of non-root user.

SIEM Detection Rules

• Falco default rules: Terminal shell in container, Contact Kubernetes API Server from Container, Write below etc, Read sensitive file.
• Tetragon: eBPF-based runtime security; policies for syscalls, capabilities, namespaces.
• Splunk SPL (K8s Audit): index=k8s verb=create resource=pods requestObject.spec.securityContext.privileged=true
• Splunk SPL (Container): index=container sourcetype=falco rule="Terminal shell in container"
• Sigma rule: sigma/rules/cloud/k8s_privileged_pod.yml
• AWS GuardDuty EKS Protection: Detector for anomalous kubectl access patterns.

Defense Evasion Techniques

Runtime Stealth

• Static binaries over interpreted scripts: Drop statically-compiled nmap instead of Python nmap-python; avoids Python interpreter dependency on Falco rules.
• LOLBins (Living off the Land): Use existing container binaries (wget, curl, awk) instead of dropping new tools; avoids write events to filesystem.
• Memory-only execution: Use memfd_create() syscall to run tools without disk artifacts; reflective DLL injection.
• Process name spoofing: Rename malicious process to nginx or redis-server to blend with legitimate workload.
• ** syscall proxying**: Use legitimate process (like nginx) to issue sensitive syscalls; inject code into worker process.

Container Escape Stealth

• CVE selection: Choose newer, less-signatured CVEs (CVE-2024-1086 netfilter) over well-known ones (CVE-2022-0185); Falco rules lag.
• Capability-based escape over privileged: Use CAP_SYS_ADMIN already in container spec rather than escalating to privileged; less suspicious.
• Lesser-monitored syscalls: Use openat2, io_uring, bpf syscalls to evade default Falco rules.
• Kernel namespace manipulation: unshare -U -r --map-root-user over setuid syscall; less signature coverage.
• Cgroup v2 abuse: Cgroup v2 has fewer monitoring tools; exploit cgroup escape via v2-specific paths.

Kubernetes Stealth

• Existing ServiceAccount over new RBAC: Use mounted SA token in compromised Pod; avoid creating new RoleBinding (logs).
• Sidecar injection over new Pod: Inject into existing Pod via shared process namespace; avoids Pod creation event.
• ConfigMap over Secret: Embed payload in ConfigMap (not flagged as sensitive); fetch via API later.
• CronJob one-shot Pod: Schedule short-lived Pod via CronJob; complete action before runtime detection sees it.
• PreStop hook abuse: Use existing Pod's preStop lifecycle hook to execute payload; blends with legitimate lifecycle.
• HostPID/HostNetwork only: Skip privileged: true; use hostPID and hostNetwork which provide many capabilities with less alarming spec.

Image / Supply Chain Stealth

• Multi-layer image obfuscation: Hide payload in lower image layers; lazy scanners may miss it.
• Cosign signature theft: Steal cosign private key; sign malicious image as legitimate.
• Admission controller bypass: Modify MutatingWebhookConfiguration to allowlist malicious images.
• Build cache poisoning: Push poisoned layer to shared cache; affects all downstream builds silently.
• Dependency confusion hybrid: Name private package similar to public one; trigger fallback to public (attacker-controlled) version.
• SBOM manipulation: Generate fake SBOM after build; submitted SBOM does not match actual image contents.

Network Stealth

• Cloudflare / API Gateway proxy: Route container traffic through Cloudflare to mask C2 destination.
• DNS tunneling over HTTP: Use DNS-over-HTTPS to bypass network policy that allows only HTTP/HTTPS.
• WebSocket over HTTP: Use WebSocket for C2 (persistent connection); evades connection-counting rate limits.
• PrivateLink / VPC peering: Use private network paths instead of internet; bypass egress monitoring.
• Service mesh abuse: Use Istio / Linkerd mTLS for C2; encrypted traffic invisible to L7 monitoring.

Persistence Stealth

• DaemonSet deployment: Use DaemonSet (runs on every node) over Deployment; harder to detect anomaly across many pods.
• Admission webhook persistence: Deploy mutating webhook as persistence; intercepts all Pod creations.
• CRD-based persistence: Use Custom Resource Definition to store payload; blends with operator-deployed resources.
• etcd direct manipulation: Modify etcd directly (if access); bypasses API server audit log.
• kubelet anonymous auth abuse: Kubelets with --anonymous-auth=true; appear as anonymous system user.

Advanced Techniques

Advanced container security testing includes: kernel exploit chains from within containers (CVE-2022-0185, CVE-2024-1086 for netfilter escape), cgroup and namespace manipulation for container breakout, seccomp profile bypass through allowed syscalls, Kubernetes admission controller bypass through direct API server access, and etcd database manipulation for cluster-level persistence. For CI/CD pipeline testing, explore build cache poisoning, dependency confusion attacks, and malicious build argument injection.

Tool Comparison Matrix

Performance and Remediation

Image scanning performance varies significantly by tool and image size. Trivy and grype complete scans of typical application images (500MB-2GB) in 10-30 seconds, while larger base images with extensive package lists can take 2-5 minutes. For large-scale deployments, use trivy in server mode with a centralized vulnerability database. Falco runtime monitoring has minimal performance impact (<2% CPU overhead). Prioritize container security remediation in order: fix Critical CVEs in base images immediately, remove privileged mode and docker.sock mounts, enforce Pod Security Standards, implement Network Policies, deploy image signing (cosign/Notary) in CI/CD, and rotate all ServiceAccount tokens after any suspected compromise.

Hacker Laws

Learning Resources

This skill's supplementary files: payloads.md, test-cases.md Related skills: skills/cloud-security/SKILL.md, skills/post-exploitation/SKILL.md External resources:

• Trivy Official Documentation - All-in-one scanner reference
• CIS Docker Benchmark - Docker security configuration baseline
• CIS Kubernetes Benchmark - K8s security configuration baseline
• Falco Official Documentation - Runtime security monitoring rule authoring
• Kubernetes Security Documentation - Pod Security Standards and RBAC
• Container Security (Liz Rice) - Underlying principles of container isolation