Escape Named Defense

Container escape literacy — named risks (privileged, host mount, kernel gap category) and defenses — on `$CLOUD_LAB` notes only, NO escape PoC cookbooks.

Escape Named Defense• Audio Walkthrough

00:00/03:24

Visual · t31_escape_named_defense

Escape = named risk + defense rows. $CLOUD_LAB literacy. NO PoC cookbooks. Original Cyberlium.

Container escape is a named defender concern — learn risks and defenses on YOUR lab notes, never step-by-step escape PoCs against stranger clusters.

Container escape literacy names risks: privileged container category, host filesystem mount (`/var/run/docker.sock` literacy), excessive Linux capabilities category, shared host PID/namespace category, and unpatched kernel/runc CVE category. Named defenses: non-root user, drop capabilities, no privileged flag, read-only rootfs, seccomp/AppArmor profile category, patch cadence, and avoid sensitive host mounts. Analyst writes risk/defense matrix on `$CLOUD_LAB` local Docker or kind YOUR cluster stub — cites Module 6-1 hygiene rows — without running escape PoCs, without `--privileged` on shared infrastructure, without attacking stranger Kubernetes nodes. Cyberlium teaches named literacy: know escape is possible when misconfigured — defend with hygiene — NOT how to break out. Refused: escape PoC cookbooks, CTF-style breakout on employer clusters, publishing breakout scripts. Lab row: four risk rows paired with defense row each.

1. Named escape risks

Privileged, host mount, excess capabilities, shared namespace, kernel gap — five literacy anchors.

Risk row ties to observable misconfig in Dockerfile or pod spec category.

Command guide

Try these commands — Named escape risks

═══ DOCKER & CONTAINER AUDIT ═══

Check container running state and port bindings

Command — copy this

docker ps --format "table {{.ID}}	{{.Image}}	{{.Status}}	{{.Ports}}" 2>/dev/null || echo "docker ps"

Inspect container for elevated capabilities and root user

Command — copy this

docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || true

Run security vulnerability scan on container image using Trivy

Command — copy this

trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"

═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace

Command — copy this

kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"

Primary tools to practice this lesson: grep, curl. Reference sites: Container escape defenses (https://kubernetes.io/docs/concepts/security/pod-security-standards/); Docker seccomp (https://docs.docker.com/engine/security/seccomp/); OWASP K8s (https://owasp.org/www-project-kubernetes-top-10/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Named defenses

Non-root, cap drop, no privileged, read-only rootfs, seccomp/AppArmor, patch — six defense anchors.

Defense matrix documents which control mitigates which risk on lab stub.

3. NO PoC boundary

Document risks and defenses on `$CLOUD_LAB` notes — never execute escape steps.

Refused: escape PoC cookbooks, stranger cluster breakout, privileged abuse on shared hosts.

4. What you ship: escape risk/defense matrix

Four risk rows + paired defense each + NEVER escape PoC cookbook line.

5. What you record before the next lesson

Escape risk/defense matrix path.

6. Wrong vs right: stranger tenants vs YOUR cloud accounts

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Follow public container escape PoC against employer Kubernetes node for 'defense validation.'
Right: Escape risk/defense matrix from `$CLOUD_LAB` literacy notes. Next: Docker Lab.

Hands-on Exercise