docker-privesc

Name: docker-privesc
Availability: InStock
Author: entrovyx

Identify and exploit Docker privilege escalation vulnerabilities to achieve host root access.

3|1|Updated Jul 2, 2026

Search Tags:#security #docker #pentest #privilege-escalation #infra #container-escape

Ready to run

npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill docker-privesc-entrovyx

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: docker-privesc
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/infra/docker-privesc
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill docker-privesc-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires curl, nmap, python3.

What problem does it solve?

This skill addresses the critical security gap where misconfigured Docker containers allow attackers to break out of their isolation and gain root access to the underlying host system.

Core Features & Use Cases

Surface Assessment: Automatically detects dangerous configurations like mounted Docker sockets, privileged mode, and excessive Linux capabilities.
Exploitation Techniques: Provides structured procedures for five distinct host-escape methods, including volume mounting and SUID binary injection.
Forensic Detection: Identifies indicators of prior compromise, such as unauthorized UID 0 users or modified sudoers files.

Quick Start

Run the docker-privesc skill to assess the current container environment for potential host escape vectors and privilege escalation opportunities.

Frequently Asked Questions about docker-privesc

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test Docker containers for privilege escalation vulnerabilities?▼

You can exploit Docker container escapes by targeting misconfigured runtimes and exposed Docker sockets using five distinct host-escape methods, including volume mounting and SUID binary injection.

What Linux capabilities allow escaping a Docker container to the host?▼

Docker socket exposure enables container escape by allowing direct interaction with the Docker daemon, which can be exploited to spawn a privileged container mounting the host filesystem.

Do I need Python3 and nmap to detect Docker misconfigurations?▼

You can identify indicators of prior Docker compromise by checking for unauthorized UID 0 users and modified sudoers files during forensic detection of the container environment.

How do I exploit Docker socket exposure to get host root access?▼

Docker socket exposure enables container escape by allowing direct interaction with the Docker daemon, which can be exploited to spawn a privileged container mounting the host filesystem.

What are the limitations of Docker container escape techniques?▼

Docker container escape techniques are limited by properly configured runtimes, restricted Linux capabilities, and secured Docker sockets, which prevent breaking out of container isolation.

EntroVyx

hunt-k8s

Identify and validate Kubernetes and Docker security misconfigurations.

hunt-k8s

Detect Kubernetes and Docker security misconfigurations and privilege escalation paths.

Community

Advanced

hardw00t

container-security

Automates container security assessments across Docker images, Kubernetes clusters, and runtimes using Trivy, Grype, Kubescape, kube-bench, and Falco.

Community

Advanced