# Container Security & Escape

> Enumerate exposed Docker APIs, abuse unauthenticated access, and escape containers through mounted sockets, privileged flags, and host namespace sharing.

- **URL:** https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/container-security-and-escape
- **Certification:** [PT2 (Penetration Tester Level 2) Study Path](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path.md)
- **Estimated study hours:** 10
- **Published:** 2026-10-04
- **Updated:** 2026-10-04

Containers isolate processes, not threat models. A single misconfiguration (a mounted Docker socket, a `--privileged` flag, a shared host namespace) turns a compromised container into root on the host it runs on. PT2 tests both exploiting an exposed Docker API from outside and escaping a container once inside it.

## Finding The API

Docker daemons left on `2375/tcp` without TLS or auth are the classic exposed-API finding. The version endpoint confirms access; container and image enumeration maps what is running. Environment variables (frequently used for secrets injection) leak credentials, cloud keys, and database passwords.

## RCE Via Exec

A reachable Docker API with no auth is RCE on every container it manages. `exec` into any running container, use the container's network reach to pivot to internal services, and callback a reverse shell. The raw REST API works identically for operators without the Docker CLI installed.

## Escape From API Access

Mount the host filesystem into a new container to read `/etc/shadow`, `/root/.ssh/authorized_keys`, and the host's docker secrets. `nsenter` into PID 1 to land directly in the host namespace. Writing an SSH key to the host's authorized_keys gives persistent access.

## Escape From Inside

Once already inside a container (through RCE on a containerized web app, for example), five classic escape primitives: Docker socket mounted at /var/run/docker.sock, `--privileged` with device access, cgroup v1 `release_agent` on misconfigured hosts, `--pid=host` for process namespace crossing, and writable host-path mounts. Each one requires one specific misconfiguration; checking for them is prerequisite work before trying the escape.

## Chaining

Container escape is rarely the final step. Host root unlocks every other container's secrets, the orchestrator's credentials, and (in cloud environments) the node's IAM role. Treat the escape as the pivot to the next module, not the finish line.

## Study material

- [Docker API Service Detection](https://hackindex.io/services/docker-api/enumeration/docker-api-service-detection.md) (read, core)
- [Docker API Unauthenticated Access](https://hackindex.io/services/docker-api/vulnerability-discovery/docker-api-unauthenticated-access.md) (read, core)
- [Docker API RCE via Exec](https://hackindex.io/services/docker-api/exploitation/docker-api-rce-via-exec.md) (read, core)
- [Docker API Container Escape](https://hackindex.io/services/docker-api/exploitation/docker-api-container-escape.md) (read, core)
- [Docker Container Escape and Host Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/docker-container-escape.md) (read, core)