Archivesecurity
Sandbox Escapes Start With a Shared Kernel
Containers isolate processes, not kernels. If the workload is hostile, that distinction is the whole threat model.
- Published
- Reading time
- 1 min read
A container is a set of Linux namespaces plus cgroups. The kernel is shared, so a kernel vulnerability or a misconfigured capability can cross the boundary.
Common escape paths
- Privileged containers: effectively root on the host.
- Mounted Docker socket: lets the workload start a privileged container.
- Host path mounts:
/proc,/sys, or the container runtime socket. - Kernel exploits: namespace and filesystem bugs.
- Seccomp disabled: the full syscall surface is reachable.
Stronger isolation
- User namespaces plus a non-root user inside the container.
- Seccomp profiles, no-new-privileges, read-only root filesystems.
- gVisor or microVMs (Firecracker) for untrusted code — a separate kernel per workload.
- Network policy so an escaped process still cannot reach the control plane.
Takeaway: containers are a packaging and resource boundary. For hostile code, use a kernel boundary too.