Lesson 4.58: Detecting a container breakout at runtime

A container process that escapes doesn't announce itself, but it can't hide its family. Its parents are still the container's processes and its cgroup still says docker-ID.scope, while its namespaces suddenly match the host's PID 1. In the lab an alert reports a download from a staging server on a container host. You walk the process tree from the download back to a container, prove with namespace links that a shell left it via nsenter, find the settings that made it possible, and contain it.

18 min

You will learn to

Trace a process to its container through the process tree
Use /proc/PID/cgroup to see which container a process belongs to
Compare namespace links with readlink
Explain how --privileged plus --pid host allows nsenter -t 1
Contain a breakout and keep the evidence

Key terms

nsenter: Runs a program inside the namespaces of another process.
/proc/PID/ns/: Links naming a process's namespaces; equal numbers mean the same namespace.
/proc/PID/cgroup: The control group of a process; container processes sit in docker-ID.scope.
--pid host: Container shares the host's PID namespace and can see every host process.
containerd-shim: The per-container parent process; its -id is the container ID.

← Sweeping for persistence · All lessons · Deepfakes, pretexting and physical attacks →