The Container Escape Room: An Exploration of Container Escapes
summary
Shows a working exploit chain that uses the dirty_pipe kernel bug to overwrite the host runc page cache and seize execution, and a live demo that uses a small C program plus eBPF-based tools to delete kernel BPF maps and silence Tetragon detection. Describes integrating behavioral traces into CI to generate native seccomp profiles, AppArmor and network policies, and claims a scan of 10k clusters with Cubscape finds 37% leaking credentials and 23% running dangerous capabilities. Includes mitigation steps and proof that the policies actually block many escapes.
AI-written summary · about
chapters (13)
- 0:00Container escapes intro
- 1:04What containers are
- 3:51Namespaces and isolation
- 6:19Container security mechanisms
- 11:37OCI spec and runtimes
- 14:04Escape vulnerabilities overview
- 15:28Kernel vulns and Dirty Pipe
- 24:22Misconfigurations as escapes
- 27:55eBPF in security tools
- 33:45Mitigating misconfigs
- 38:00Leaky Vessels runtime vulns
- 40:56MicroVMs and isolation
- 43:27Key takeaways
related talks
43mA Compendium of Container Escapes
32mContainer Escape Paths Nobody Monitors: Abusing Linux Debug Interfaces
39mInsecure Containers? Continuous Defense Against Open Source Exploits
31mContainer Escape: All You Need Is Cap (Capabilities)
41mEscaping Virtualized Containers
35mContainers Attack and Defense
34mHow Clusters Fail Under Attack and How We Detect It at Runtime with eBPF signals
30mFinding Imposter Among Us: Container Edition