Getting out of the box¶

A container is a process with opinions about what it can see. The boundary is a set of kernel features rather than a hypervisor, so leaving it means finding the feature that was relaxed: a capability left in, a socket mounted through, a path from the container’s filesystem to the host’s. Most escapes are configuration rather than exploitation, and the configuration was usually deliberate, because something legitimate needed it.