# Container Overview

> Container / Kubernetes attack category — pod escape, RBAC abuse, runtime CVE exploitation, socket-mount escape. Routing skill: identify the surface (pod-internal RCE vs API-level vs build-pipeline), then load the matching sub-skill.

- Skill: `purpleailab/container-overview` (Agent Skill)
- Install (CLI): `npx skillmds@latest add purpleailab/container-overview`
- Raw SKILL.md: https://api.skillmd.com/api/skills/purpleailab/container-overview/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: purpleailab (https://skillmd.com/u/purpleailab)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/purpleailab/container-overview

---


# Container / Kubernetes Attack Category

This is a routing skill for cloud-native engagements. Identify the surface, then load the matching sub-skill.

## Sub-skills

| Sub-skill | Covers | When to load |
|---|---|---|
| **k8s-pod-escape** | Privileged container, hostPath escape, hostPID + SYS_PTRACE, runC CVE chains, cgroup release agent | RCE inside a pod, goal is node compromise | `load_skill("/skills/standard/cloud/container/k8s-pod-escape/SKILL.md")` |
| **k8s-rbac-abuse** | `auth can-i --list`, pods/exec on privileged pods, secrets get/list, escalate verb, bind verb, impersonate, nodes/proxy | You have a ServiceAccount token; goal is cluster-admin | `load_skill("/skills/standard/cloud/container/k8s-rbac-abuse/SKILL.md")` |
| **docker-socket-mount** | `/var/run/docker.sock` or containerd socket mounted in → instant host root | CI runners, ArgoCD/Flux, DinD, Jenkins agents | `load_skill("/skills/standard/cloud/container/docker-socket-mount/SKILL.md")` |
| **container-cve** | Catalog of high-impact runtime CVEs — Leaky Vessels, runC 2019-5736, BuildKit chain, CRI-O 2022-0811 | Container runtime version fingerprinted | `load_skill("/skills/standard/cloud/container/container-cve/SKILL.md")` |

## Quick routing

```
Container target identified?
├── You have RCE in a pod / container         → k8s-pod-escape
├── You have a Kubernetes SA token            → k8s-rbac-abuse
├── Socket mounted (`docker.sock`, etc.)      → docker-socket-mount
├── Runtime version is old / vulnerable       → container-cve
└── Unknown / all of above                     → start with k8s-pod-escape's Phase 1
```

## Tooling

| Tool | Use |
|---|---|
| `kubectl` | API-level enumeration and abuse |
| `kube-hunter` | Automated cluster vulnerability scan |
| `kdigger` | In-cluster recon (Quarkslab) |
| `peirates` | Kubernetes-specific privilege escalation |
| `botb` | Container break-out (Brad-Beam et al.) |
| `nsenter` | Cross-namespace process / mount entry |
| `crictl` / `ctr` / `nerdctl` | containerd / CRI direct access |