Container Escape Techniques

This is a practical reference for breaking out of Docker containers, LXC, or Kubernetes pods when you're already inside and need host access. It covers the standard escape vectors: privileged containers, capability abuse (CAP_SYS_ADMIN, CAP_SYS_PTRACE), Docker socket exploitation, cgroup release_agent tricks, and namespace manipulation. The guide includes working commands for each technique, from simple nsenter escalation to cgroup v1 release_agent chains and runtime CVEs like runc 5736. It also flags when to pivot to related skills for privilege escalation inside the container first or Kubernetes-specific attacks. Good for red team work or understanding what makes a container configuration dangerous. The detection section helps confirm you're containerized before trying escape techniques.

skills.sh installs: 3.8K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill container-escape-techniques --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: Container Escape Techniques — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert container escape techniques. Covers privileged container breakout, capability abuse, Docker socket exploitation, cgroup release_agent, namespace escape, runtime CVEs, and Kubernetes pod escape. Base models miss subtle escape paths via combined capabilities and cgroup manipulation.

0. RELATED ROUTING

Before going deep, consider loading:

linux-privilege-escalation when you first need root inside the container before attempting escape
kubernetes-pentesting for K8s-specific attack paths beyond pod escape
linux-security-bypass when seccomp/AppArmor blocks your escape technique