Container & Kubernetes Security
Containers and Kubernetes have become the de facto standard for deploying modern applications. However, misconfigurations, excessive privileges, and weak isolation create significant attack surface. This guide covers container escapes, Kubernetes attacks, and cloud-native security testing.
Production Environment Caution
Container vs Kubernetes Testing
🐳 Container Security (Docker/Podman)
- • Container escape to host OS
- • Privileged container abuse
- • Docker socket (/var/run/docker.sock) exploitation
- • Image vulnerability scanning
- • Secrets extraction from layers
☸️ Kubernetes Security
- • Cluster enumeration and RBAC bypass
- • Service account token theft
- • Pod escape to worker node
- • Lateral movement between namespaces
- • Secrets and ConfigMap extraction
Common Attack Vectors
1. Misconfigured RBAC
Overly permissive ClusterRoleBindings allow privilege escalation. Default service accounts with excessive permissions.
2. Exposed Kubernetes API
Internet-facing API server without authentication. Weak authentication mechanisms (static tokens, client certs).
3. Privileged Containers
Running containers with --privileged flag or dangerous capabilities (SYS_ADMIN, SYS_PTRACE) enables host escape.
4. Secrets in Images
Hardcoded credentials, API keys, and private keys embedded in container layers. Accessible via docker history.
Container Escape Techniques
Privileged Container
Mount host filesystem and chroot:
mkdir /host && mount /dev/sda1 /host && chroot /host Docker Socket
Spawn privileged container:
docker -H unix:///host/var/run/docker.sock run -v /:/host -it alpine chroot /host hostPath Volume
Pod mounts host filesystem:
volumeMounts: - mountPath: /host - name: hostfs Kernel Exploits
Dirty COW, runc CVE-2019-5736:
./exploit → root on host Essential K8s Attack Tools
Enumeration
- • kubectl
- • kubeletctl
- • kdigger
- • kubeaudit
Exploitation
- • Peirates
- • kube-hunter
- • CDK (Container Duck)
- • BOtB
Scanning
- • Trivy
- • Grype
- • Clair
- • Falco (runtime)
Always Check Service Accounts
/var/run/secrets/kubernetes.io/serviceaccount/token.
Use this token to authenticate to the Kubernetes API and enumerate cluster resources.
Guide Contents
Container Basics
Docker fundamentals and container isolation mechanisms.
Container Escapes
Breaking out of containers to access the host system.
K8s Architecture
Understanding Kubernetes security architecture.
K8s Enumeration
Discovering and enumerating Kubernetes clusters.
K8s Attacks
Exploiting Kubernetes misconfigurations.
Image Scanning
Scanning container images for vulnerabilities.
Supply Chain
Container supply chain security and registry attacks.
Runtime Security
Container runtime monitoring and evasion.
Service Mesh
Attacking Istio and service mesh implementations.