Cloud › Module 6 › Lesson 3
Escape Named Defense
Container escape literacy — named risks (privileged, host mount, kernel gap category) and defenses — on `$CLOUD_LAB` notes only, NO escape PoC cookbooks.
Visual · t31_escape_named_defense
Escape = named risk + defense rows. $CLOUD_LAB literacy. NO PoC cookbooks. Original Cyberlium.
Opening
Container escape is a named defender concern — learn risks and defenses on YOUR lab notes, never step-by-step escape PoCs against stranger clusters.
Container escape literacy names risks: privileged container category, host filesystem mount (`/var/run/docker.sock` literacy), excessive Linux capabilities category, shared host PID/namespace category, and unpatched kernel/runc CVE category. Named defenses: non-root user, drop capabilities, no privileged flag, read-only rootfs, seccomp/AppArmor profile category, patch cadence, and avoid sensitive host mounts. Analyst writes risk/defense matrix on `$CLOUD_LAB` local Docker or kind YOUR cluster stub — cites Module 6-1 hygiene rows — without running escape PoCs, without `--privileged` on shared infrastructure, without attacking stranger Kubernetes nodes. Cyberlium teaches named literacy: know escape is possible when misconfigured — defend with hygiene — NOT how to break out. Refused: escape PoC cookbooks, CTF-style breakout on employer clusters, publishing breakout scripts. Lab row: four risk rows paired with defense row each.
1. Named escape risks
Privileged, host mount, excess capabilities, shared namespace, kernel gap — five literacy anchors.
Risk row ties to observable misconfig in Dockerfile or pod spec category.
Command guide
Try these commands — Named escape risks
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Container escape defenses — https://kubernetes.io/docs/concepts/security/pod-security-standards/
Optional command
Docker seccomp — https://docs.docker.com/engine/security/seccomp/
OWASP K8s — https://owasp.org/www-project-kubernetes-top-10/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export CLOUD_LAB=${CLOUD_LAB:-$HOME/cyberlium-lab/t31-cloud}
curl -sS https://kubernetes.io/docs/concepts/security/pod-security-standards/ | head -10
cat > "$CLOUD_LAB/containers/escape-named-defenses.txt" <<'EOF'
Container escape — NAMED LITERACY + DEFENSES ONLY (no PoC recipes):
Risk: privileged container, hostPath mount, CAP_SYS_ADMIN, kernel CVE
Defenses: Pod Security Standards (restricted), seccomp/AppArmor, no privileged
Defenses: read-only rootfs, drop ALL caps, user namespaces
Defenses: keep host kernel patched; minimal attack surface
HARD BAN: run escape PoCs, publish breakout cookbooks, test on stranger clusters
EOFCommand — copy this
grep -E 'Defenses|HARD BAN|privileged' "$CLOUD_LAB/containers/escape-named-defenses.txt"
Primary tools to practice this lesson: grep, curl. Reference sites: Container escape defenses (https://kubernetes.io/docs/concepts/security/pod-security-standards/); Docker seccomp (https://docs.docker.com/engine/security/seccomp/); OWASP K8s (https://owasp.org/www-project-kubernetes-top-10/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Named defenses
Non-root, cap drop, no privileged, read-only rootfs, seccomp/AppArmor, patch — six defense anchors.
Defense matrix documents which control mitigates which risk on lab stub.
3. NO PoC boundary
Document risks and defenses on `$CLOUD_LAB` notes — never execute escape steps.
Refused: escape PoC cookbooks, stranger cluster breakout, privileged abuse on shared hosts.
4. What you ship: escape risk/defense matrix
Four risk rows + paired defense each + NEVER escape PoC cookbook line.
5. What you record before the next lesson
Escape risk/defense matrix path.
6. Wrong vs right: stranger tenants vs YOUR cloud accounts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Follow public container escape PoC against employer Kubernetes node for 'defense validation.'
Right
Escape risk/defense matrix from `$CLOUD_LAB` literacy notes. Next: Docker Lab.
Mission: escape risk/defense matrix
1) Name four escape risk categories. 2) Paired defense per risk. 3) Link to Module 6-1 hygiene row. 4) Write NEVER escape PoC cookbook line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “docker.sock mount — defense literacy default?”
Knowledge Check
APPLY: Escape literacy on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Container escape PoC cookbooks are course lab.
True or False
Knowledge Check
APPLY: Defense for privileged risk includes:
Multiple choice