Container Escape Vulnerabilities: Prevention and Detection

1
2
3
4
5
6

# Dangerous: Running container with --privileged flag
docker run --privileged -it ubuntu:latest /bin/bash

# Inside container - direct host access
root@container:/# fdisk -l  # Can see host disks
root@container:/# mount /dev/sda1 /mnt  # Mount host filesystem

1
2
3
4
5

# Dangerous: Mounting host root to container
docker run -v /:/host ubuntu:latest

# Inside container
root@container:/# chroot /host /bin/bash  # Escape to host

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

# Secure container image example
FROM python:3.11-alpine

# Create non-root user early
RUN addgroup -g 1001 appgroup && \
    adduser -D -u 1001 -G appgroup appuser

# Install dependencies as root, then switch
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

# Copy application files
COPY --chown=appuser:appgroup . /app
WORKDIR /app

# Remove unnecessary packages and files
RUN apk del --purge build-deps && \
    rm -rf /var/cache/apk/* /tmp/*

# Switch to non-root user
USER appuser

# Use specific user ID for better security
USER 1001:1001

# Set read-only filesystem
VOLUME ["/tmp"]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61

# Kubernetes security context example
apiVersion: v1
kind: Pod
metadata:
  name: secure-app
spec:
  securityContext:
    # Run as non-root user
    runAsNonRoot: true
    runAsUser: 1001
    runAsGroup: 1001
    
    # Prevent privilege escalation
    allowPrivilegeEscalation: false
    
    # Set filesystem as read-only
    readOnlyRootFilesystem: true
    
    # Drop all capabilities
    capabilities:
      drop:
        - ALL
      add:
        - NET_BIND_SERVICE  # Only if needed
    
    # Use restricted seccomp profile
    seccompProfile:
      type: RuntimeDefault
    
    # Set SELinux context
    seLinuxOptions:
      level: "s0:c123,c456"
  
  containers:
  - name: app
    image: myapp:latest
    
    # Resource limits
    resources:
      limits:
        memory: "256Mi"
        cpu: "200m"
      requests:
        memory: "128Mi"
        cpu: "100m"
    
    # Volume mounts with restrictions
    volumeMounts:
    - name: tmp-volume
      mountPath: /tmp
      readOnly: false
    - name: app-data
      mountPath: /app/data
      readOnly: true
    
  volumes:
  - name: tmp-volume
    emptyDir: {}
  - name: app-data
    configMap:
      name: app-config

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

# Network policy for container isolation
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: container-isolation
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: web-service
  policyTypes:
  - Ingress
  - Egress
  
  # Restrict ingress traffic
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: api-gateway
    ports:
    - protocol: TCP
      port: 8080
  
  # Restrict egress traffic
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          name: database
    ports:
    - protocol: TCP
      port: 5432
  # Allow DNS resolution
  - to: []
    ports:
    - protocol: UDP
      port: 53

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

# Falco rules for container escape detection
- rule: Container Escape Detection
  desc: Detect potential container escape attempts
  condition: >
    spawned_process and
    (proc.name in (chroot, nsenter, unshare) or
     proc.cmdline contains "mount /dev" or
     proc.cmdline contains "/proc/1/root" or
     proc.cmdline contains "docker.sock")
  output: >
    Potential container escape detected 
    (user=%user.name command=%proc.cmdline container=%container.name)
  priority: CRITICAL

- rule: Privileged Container Spawn
  desc: Detect containers running with dangerous privileges
  condition: >
    container and
    (container.privileged=true or
     container.effective_capabilities contains CAP_SYS_ADMIN)
  output: >
    Privileged container detected 
    (container=%container.name privileges=%container.effective_capabilities)
  priority: HIGH

- rule: Suspicious File Access
  desc: Detect access to sensitive host files from containers
  condition: >
    open_read and
    container and
    (fd.name startswith /proc/1/root/ or
     fd.name=/etc/shadow or
     fd.name=/etc/passwd or
     fd.name startswith /var/run/docker.sock)
  output: >
    Suspicious file access from container 
    (file=%fd.name container=%container.name user=%user.name)
  priority: HIGH

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96

#!/usr/bin/env python3
import subprocess
import json
import logging
from datetime import datetime

class ContainerEscapeDetector:
    def __init__(self):
        self.logger = logging.getLogger(__name__)
        
    def check_running_containers(self):
        """Check for dangerous container configurations"""
        try:
            # Get running containers
            result = subprocess.run(
                ['docker', 'ps', '--format', 'json'],
                capture_output=True, text=True, check=True
            )
            
            containers = [json.loads(line) for line in result.stdout.strip().split('\n')]
            
            for container in containers:
                self.analyze_container_security(container['ID'])
                
        except subprocess.CalledProcessError as e:
            self.logger.error(f"Failed to list containers: {e}")
    
    def analyze_container_security(self, container_id):
        """Analyze individual container for security issues"""
        try:
            # Inspect container configuration
            result = subprocess.run(
                ['docker', 'inspect', container_id],
                capture_output=True, text=True, check=True
            )
            
            config = json.loads(result.stdout)[0]
            
            # Check for dangerous configurations
            security_issues = []
            
            # Check privileged mode
            if config['HostConfig'].get('Privileged', False):
                security_issues.append("CRITICAL: Container running in privileged mode")
            
            # Check volume mounts
            for mount in config.get('Mounts', []):
                if mount['Source'] == '/':
                    security_issues.append("CRITICAL: Root filesystem mounted")
                elif mount['Source'].startswith('/proc'):
                    security_issues.append("HIGH: Proc filesystem mounted")
                elif mount['Source'] == '/var/run/docker.sock':
                    security_issues.append("CRITICAL: Docker socket mounted")
            
            # Check capabilities
            added_caps = config['HostConfig'].get('CapAdd', [])
            if 'SYS_ADMIN' in added_caps or 'ALL' in added_caps:
                security_issues.append("HIGH: Dangerous capabilities granted")
            
            # Check network mode
            if config['HostConfig'].get('NetworkMode') == 'host':
                security_issues.append("MEDIUM: Host network mode enabled")
            
            # Report issues
            if security_issues:
                self.report_security_issues(container_id, security_issues)
                
        except subprocess.CalledProcessError as e:
            self.logger.error(f"Failed to inspect container {container_id}: {e}")
    
    def report_security_issues(self, container_id, issues):
        """Report detected security issues"""
        for issue in issues:
            self.logger.warning(f"Container {container_id[:12]}: {issue}")
            
            # Integration with SIEM/alerting system
            alert_data = {
                'timestamp': datetime.utcnow().isoformat(),
                'container_id': container_id,
                'issue': issue,
                'severity': issue.split(':')[0]
            }
            
            # Send to monitoring system
            self.send_alert(alert_data)
    
    def send_alert(self, alert_data):
        """Send alert to monitoring system"""
        # Implementation depends on your monitoring stack
        # Examples: Elasticsearch, Splunk, Datadog, etc.
        pass

# Usage
if __name__ == "__main__":
    detector = ContainerEscapeDetector()
    detector.check_running_containers()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51

#!/bin/bash
# Host-level container escape detection script

# Monitor for suspicious processes
monitor_processes() {
    # Check for processes trying to access container filesystems
    ps aux | grep -E "(chroot|nsenter|unshare)" | grep -v grep
    
    # Check for processes accessing Docker socket
    lsof | grep docker.sock
    
    # Monitor process tree for unusual parent-child relationships
    pstree -p | grep -E "containerd|docker|runc"
}

# Check for unauthorized mount operations
monitor_mounts() {
    # Recent mount operations
    dmesg | tail -50 | grep -i mount
    
    # Current mounts that might indicate escape
    mount | grep -E "(/proc/1/root|/var/run/docker.sock)"
}

# Monitor system calls indicating potential escape
monitor_syscalls() {
    # Use auditd to track dangerous system calls
    auditctl -a always,exit -F arch=b64 -S mount -k container_escape
    auditctl -a always,exit -F arch=b64 -S unshare -k container_escape
    auditctl -a always,exit -F arch=b64 -S setns -k container_escape
}

# Network monitoring for unusual container traffic
monitor_network() {
    # Check for containers communicating on unexpected ports
    netstat -tuln | grep -E ":22|:443|:80" | head -10
    
    # Monitor for containers accessing host network
    ss -tuln | grep -v "127.0.0.1\|::1"
}

# Main monitoring loop
while true; do
    echo "$(date): Running container escape detection..."
    
    monitor_processes
    monitor_mounts
    monitor_network
    
    sleep 30
done

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

# Enable kernel security features
echo "kernel.yama.ptrace_scope = 3" >> /etc/sysctl.conf
echo "kernel.kptr_restrict = 2" >> /etc/sysctl.conf
echo "net.core.bpf_jit_harden = 2" >> /etc/sysctl.conf

# Apply AppArmor/SELinux profiles for containers
# AppArmor profile example
cat > /etc/apparmor.d/docker-containers << 'EOF'
#include <tunables/global>

profile docker-containers flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>
  
  # Deny dangerous capabilities
  deny capability sys_admin,
  deny capability sys_module,
  deny capability sys_rawio,
  
  # Allow only necessary file access
  /usr/bin/** ix,
  /bin/** ix,
  /lib/** r,
  /etc/passwd r,
  /etc/group r,
  
  # Deny access to sensitive areas
  deny /proc/sys/** w,
  deny /sys/** w,
  deny /dev/mem r,
  deny /dev/kmem r,
}
EOF

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

# gVisor (runsc) configuration for enhanced isolation
apiVersion: node.k8s.io/v1
kind: RuntimeClass
metadata:
  name: gvisor
handler: runsc

---
apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  runtimeClassName: gvisor  # Use gVisor for better isolation
  containers:
  - name: app
    image: myapp:latest