Skip to content
HackIndex.io

PT2 · Module 6

Container Security & Escape

Enumerate exposed Docker APIs, abuse unauthenticated access, and escape containers through mounted sockets, privileged flags, and host namespace sharing.

~10 h 5 resources Last updated October 4, 2026

Containers isolate processes, not threat models. A single misconfiguration (a mounted Docker socket, a --privileged flag, a shared host namespace) turns a compromised container into root on the host it runs on. PT2 tests both exploiting an exposed Docker API from outside and escaping a container once inside it.

Finding The API

Docker daemons left on 2375/tcp without TLS or auth are the classic exposed-API finding. The version endpoint confirms access; container and image enumeration maps what is running. Environment variables (frequently used for secrets injection) leak credentials, cloud keys, and database passwords.

RCE Via Exec

A reachable Docker API with no auth is RCE on every container it manages. exec into any running container, use the container's network reach to pivot to internal services, and callback a reverse shell. The raw REST API works identically for operators without the Docker CLI installed.

Escape From API Access

Mount the host filesystem into a new container to read /etc/shadow, /root/.ssh/authorized_keys, and the host's docker secrets. nsenter into PID 1 to land directly in the host namespace. Writing an SSH key to the host's authorized_keys gives persistent access.

Escape From Inside

Once already inside a container (through RCE on a containerized web app, for example), five classic escape primitives: Docker socket mounted at /var/run/docker.sock, --privileged with device access, cgroup v1 release_agent on misconfigured hosts, --pid=host for process namespace crossing, and writable host-path mounts. Each one requires one specific misconfiguration; checking for them is prerequisite work before trying the escape.

Chaining

Container escape is rarely the final step. Host root unlocks every other container's secrets, the orchestrator's credentials, and (in cloud environments) the node's IAM role. Treat the escape as the pivot to the next module, not the finish line.

Read

The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.

Practice

Apply the module hands-on.

All PT2 practice machines