skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-container-escape-detection

Detects container escape vectors in Kubernetes pods by auditing security contexts, capabilities, and host mounts.

954|172|Updated Mar 13, 2026
Search Tags:#kubernetes#container security#Python#capabilities#privileged containers#escape detection#hostpath
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-container-escape-detection
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-container-escape-detection
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/container-security/performing-container-escape-detection
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-container-escape-detection

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires kubernetes.

What problem does it solve?

Container escape vulnerabilities let attackers break out of isolated containers to compromise the host system, but auditing pod specifications manually is error-prone and often misses subtle misconfigurations like dangerous capabilities or writable hostPath mounts.

Core Features & Use Cases

  • Privileged Container Detection: Scans all pods across namespaces to identify containers running in privileged mode with full host access.
  • Capability and Namespace Auditing: Checks for dangerous capabilities like CAP_SYS_ADMIN and CAP_DAC_READ_SEARCH (CVE-2022-0492), plus host PID, IPC, and network namespace sharing.
  • HostPath Mount Analysis: Identifies writable hostPath mounts and exposed Docker sockets that enable escape paths.
  • Use Case: During a Kubernetes security assessment, run the audit to enumerate every pod with escape-prone configurations, then validate findings by attempting the escape in an authorized throwaway namespace.

Quick Start

Audit all Kubernetes pods in my cluster for container escape vectors including privileged mode, dangerous capabilities, and writable hostPath mounts.

Frequently Asked Questions about performing-container-escape-detection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect privileged containers in Kubernetes with Python?▼

Use the kubernetes Python client to list pods across all namespaces and inspect each container's securityContext.privileged field. Load credentials with config.load_kube_config(), then iterate pod.spec.containers to flag any container where privileged is true.

What container escape vectors should a Kubernetes audit check?▼

Check privileged mode, added capabilities like SYS_ADMIN, SYS_PTRACE, and DAC_READ_SEARCH, hostPID/hostIPC/hostNetwork sharing, writable hostPath mounts to sensitive paths, and Docker socket mounts. Also inspect initContainers and ephemeralContainers, which are common blind spots.

Does checking only securityContext.privileged catch all escape risks?▼

No. A non-privileged pod with CAP_SYS_ADMIN can still escape, and pod-level versus container-level securityContext settings do not imply each other. You must enumerate the full matrix of capabilities, namespace sharing, seccomp profiles, and host mounts.

How do I find Docker socket mounts in Kubernetes pods?▼

Iterate pod.spec.volumes and check each volume's host_path.path for docker.sock. A mounted /var/run/docker.sock gives the container full control over the host's Docker daemon, enabling trivial escape.

What are the limitations of static pod-spec audits for escape detection?▼

A static audit only shows configuration weaknesses, not actual exploitation. A clean result does not prove no escape occurred, so cross-check findings against runtime detection tools like Tetragon or Falco and validate with authorized live testing.

Related Skills

Explore More Software Engineering Skills→
eveldeveld
10

k8s-query

Query Kubernetes resources to determine cluster state and resource health.

Community
Intermediate
infantesromeroadrianinfantesromeroadrian

pentest-container-breakout

Analyze container and Kubernetes breakout techniques for offensive security operations.

Community
Advanced
balsm-healthbalsm-health
2

detecting-container-escape-attempts

Detect container escape attempts via eBPF syscall monitoring and audit logging.

Official
Advanced
prototypdigitalprototypdigital

config-echo

Cross-reference bluetemberg session memory items with disk configuration.

Official
Advanced