Agent skill · security · yaklang
container-escape-techniques
Container escape playbook. Use when operating inside a Docker container, LXC, or Kubernetes pod and need to escape to the host via privileged mode, capabilities, Docker socket, cgroup abuse, namespace tricks, or runtime vulnerabilities.
Why this skill is useful
Adds detailed executable scripts and techniques for escaping from containers that are not commonly known or documented.
What it needs
Requires amicontained, cdk, deepce installed locally. About 5k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Container Escape Techniques — Expert Attack Playbook AI LOAD INSTRUCTION: Expert container escape techniques. Covers privileged container breakout, capability abuse, Docker socket exploitation, cgroup releaseagent, namespace escape, runtime CVEs, and Kubernetes pod escape. Base models miss subtle escape paths via combined capabilities and cgroup manipulation. 0. RELATED ROUTING Before going deep, consider loading: linux-privilege-escalation when you first need root inside the container before attempting escape kubernetes-pentesting for K8s-specific attack paths beyond pod escape linux-security-bypass when seccomp/AppArmor blocks your escape technique Advanced Reference Also load DOCKERESCAPECHAINS.md when you need: Step-by-step escape chains for common misconfigurations Docker-in-Docker escape scenarios Kubernetes-specific escape paths with full command sequences --- 1. AM I IN A CONTAINER? Tools for Container Detection --- 2. PRIVILEGED CONTAINER ESCAPE If --privileged flag was used, the container has nearly all host capabilities and device access. 2.1 Mount Host Filesystem 2.2 nsenter (Enter Host Namespaces) 2.3 Privileged + Host PID Namespace --- 3. CAPABILITY-BASED ESCAPE 3.1 CAPSYSADMIN — Most Versatile 3.2 CAPSYSPTRACE — Process Injection 3.3 CAPNETADMIN 3.4 CAPDACREADSEARCH (Shocker Exploit) --- 4. DOCKER SOCKET ESCAPE (/var/run/docker.sock) --- 5. CGROUP V1 RELEASEAGENT ESCAPE Classic escape for containers with CAPSYSADMIN + cgroup v1. --- 6. CGROUP V2 / eBPF ESCAPE --- 7. NAMESPACE ESCAPE User Namespace PID Namespace Escape --- 8. RUNTIME VULNERABILITIES runc CVE-2019-5736 Overwrites host runc binary when docker exec is used. containerd CVE-2020-15257 cgroups CVE-2022-0492 --- 9. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/container-escape-techniques