skills.rest
EntroVyx
EntroVyxCOMMUNITY
Explore all skills by this author →
GitHub

docker-privesc

Identify and exploit Docker privilege escalation vulnerabilities to achieve host root access.

3|1|Updated Jul 2, 2026
Search Tags:#security#docker#pentest#privilege-escalation#infra#container-escape
One-click install
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill docker-privesc-entrovyx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: docker-privesc
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/infra/docker-privesc
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill docker-privesc-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires curl, nmap, python3.

What problem does it solve?

This skill addresses the critical security gap where misconfigured Docker containers allow attackers to break out of their isolation and gain root access to the underlying host system.

Core Features & Use Cases

  • Surface Assessment: Automatically detects dangerous configurations like mounted Docker sockets, privileged mode, and excessive Linux capabilities.
  • Exploitation Techniques: Provides structured procedures for five distinct host-escape methods, including volume mounting and SUID binary injection.
  • Forensic Detection: Identifies indicators of prior compromise, such as unauthorized UID 0 users or modified sudoers files.

Quick Start

Run the docker-privesc skill to assess the current container environment for potential host escape vectors and privilege escalation opportunities.

Frequently Asked Questions about docker-privesc

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test Docker containers for privilege escalation vulnerabilities?▼

You can exploit Docker container escapes by targeting misconfigured runtimes and exposed Docker sockets using five distinct host-escape methods, including volume mounting and SUID binary injection.

What Linux capabilities allow escaping a Docker container to the host?▼

Docker socket exposure enables container escape by allowing direct interaction with the Docker daemon, which can be exploited to spawn a privileged container mounting the host filesystem.

Do I need Python3 and nmap to detect Docker misconfigurations?▼

You can identify indicators of prior Docker compromise by checking for unauthorized UID 0 users and modified sudoers files during forensic detection of the container environment.

How do I exploit Docker socket exposure to get host root access?▼

Docker socket exposure enables container escape by allowing direct interaction with the Docker daemon, which can be exploited to spawn a privileged container mounting the host filesystem.

What are the limitations of Docker container escape techniques?▼

Docker container escape techniques are limited by properly configured runtimes, restricted Linux capabilities, and secured Docker sockets, which prevent breaking out of container isolation.

Related Skills

Explore More Software Engineering Skills→
EntroVyxEntroVyx
3

hunt-k8s

Identify and validate Kubernetes and Docker security misconfigurations.

Community
Advanced
uphiagouphiago
1.1k

hunt-k8s

Detect Kubernetes and Docker security misconfigurations and privilege escalation paths.

Community
Advanced
hardw00thardw00t
90

container-security

Automates container security assessments across Docker images, Kubernetes clusters, and runtimes using Trivy, Grype, Kubescape, kube-bench, and Falco.

Community
Advanced
salmanabdurrahmansalmanabdurrahman

container-docker

Audit Docker daemons, images, and container runtimes for misconfigurations and vulnerabilities.

Community
Advanced