domains / families / security / docker-privesc

docker-privesc

separate

Escape Docker containers to host root via 5 techniques.

When to use

• You have shell access to a Docker container (via webshell, SSH, or API exploit).
• `id` shows you're in the `docker` group or have access to `/var/run/docker.sock`.
• `docker ps` or `docker info` works from within the container.
• After `api-noauth-hunt` or `wordpress-full-compromise` achieves RCE in a container.
• Docker socket is mounted at `/var/run/docker.sock` (check: `ls -la /var/run/docker.sock`).

Skill page

Source