How do I install the Cloud Container Escape skill?

Run npx skillmds@latest add noorqureshi/cloud-container-escape in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Cloud Container Escape safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Cloud Container Escape?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Cloud Container Escape free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Cloud Container Escape?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Cloud Container Escape by noorqureshi

Name: Cloud Container Escape
Author: NoorQureshi

Cloud Container Escape

Break out of a container to the host. Load when you have a shell in a container/pod and want the node: privileged container, mounted docker.sock, dangerous capabilities, hostPath, or "escape the container". Signals: /.dockerenv, cgroup shows docker/k8s, CAP_SYS_ADMIN, mounted socket.

NoorQureshi a625630 2.1 KB Updated Sep 17, 2026

File contents

Container escape → host

When it applies

You have code execution inside a container and want the underlying host (and from there, other containers / the cluster / cloud creds).

Why it works

Containers are isolation by configuration, not a hard boundary. Privileged mode, extra capabilities, mounted host resources, or an exposed Docker socket give processes inside the container direct control over the host kernel/daemon.

Method

Confirm & enumerate: /.dockerenv, /proc/1/cgroup; run amicontained/deepce to list capabilities, seccomp, and mounts.
Exploit the misconfig:
- Docker socket mounted (/var/run/docker.sock): docker -H unix://... run -v /:/host ... → mount host FS as root → escape.
- Privileged / CAP_SYS_ADMIN: mount the host disk, or use the classic release_agent cgroup notify_on_release trick to run a command on the host.
- hostPath / host mounts: write to host filesystem (cron, ssh keys, kubelet config).
- hostPID: access host processes; nsenter into PID 1's namespaces.
From the host: grab cloud metadata creds (→ cloud-imds-ssrf), pivot to other containers/nodes (→ cloud-kubernetes).

Gotchas

Enumerate capabilities/mounts first — the escape depends entirely on which misconfig exists.
Kernel-exploit escapes are last-resort and risky on live targets; prefer the config-based paths.
On bug bounty, a proven mount of the host FS is enough — don't disrupt the node.

Verify success

Command execution or file read/write on the host (outside the container namespace) — e.g. host /etc/shadow, other containers, or the kubelet/cloud creds.

References

deepce/amicontained; "Understanding Docker container escapes" (Trail of Bits); HackTricks.

---name: cloud-container-escapedescription: Break out of a container to the host. Load when you have a shell in a container/pod and want the node: privileged container, mounted docker.sock, dangerous capabilities, hostPath, or "escape the container". Signals: /.dockerenv, cgroup shows docker/k8s, CAP_SYS_ADMIN, mounted socket.---# Container escape → host## When it appliesYou have code execution inside a container and want the underlying host (and from there, othercontainers / the cluster / cloud creds).## Why it worksContainers are isolation by configuration, not a hard boundary. Privileged mode, extracapabilities, mounted host resources, or an exposed Docker socket give processes inside thecontainer direct control over the host kernel/daemon.## Method1. **Confirm & enumerate**: `/.dockerenv`, `/proc/1/cgroup`; run `amicontained`/`deepce` to list capabilities, seccomp, and mounts.2. **Exploit the misconfig**: - **Docker socket mounted** (`/var/run/docker.sock`): `docker -H unix://... run -v /:/host ...` → mount host FS as root → escape. - **Privileged / CAP_SYS_ADMIN**: mount the host disk, or use the classic `release_agent` cgroup notify_on_release trick to run a command on the host. - **hostPath / host mounts**: write to host filesystem (cron, ssh keys, kubelet config). - **hostPID**: access host processes; `nsenter` into PID 1's namespaces.3. **From the host**: grab cloud metadata creds (→ `cloud-imds-ssrf`), pivot to other containers/nodes (→ `cloud-kubernetes`).## Gotchas- Enumerate capabilities/mounts first — the escape depends entirely on which misconfig exists.- Kernel-exploit escapes are last-resort and risky on live targets; prefer the config-based paths.- On bug bounty, a proven mount of the host FS is enough — don't disrupt the node.## Verify successCommand execution or file read/write on the host (outside the container namespace) — e.g. host`/etc/shadow`, other containers, or the kubelet/cloud creds.## References`deepce`/`amicontained`; "Understanding Docker container escapes" (Trail of Bits); HackTricks.

Frequently asked questions