Understanding Docker container escapes

Summary: Trail of Bits analyzed Felix Wilhelm's July 2019 proof-of-concept that escapes a Docker container by abusing the Linux cgroup v1 notify_on_release feature, which runs a release_agent command as fully privileged root on the host when the last task leaves a cgroup. The original PoC required the --privileged flag, but the researchers showed a simpler variant needing only --security-opt apparmor=unconfined and --cap-add=SYS_ADMIN, since SYS_ADMIN permits the mount syscall and the default docker-default AppArmor policy otherwise blocks it.
Key Takeaway: The escape does not need --privileged: a container run with SYS_ADMIN and AppArmor unconfined can mount a cgroup read-write and execute a command as root on the host, and the researchers note these granular settings are often forgotten.

Read the original at Trail of Bits Blog ↗