---
id: 1940
title: "Understanding Docker container escapes"
source_domain: blog.trailofbits.com
source_url: "https://blog.trailofbits.com/2019/07/19/understanding-docker-container-escapes/"
published_at: "2019-07-20T01:01:09Z"
tags: ["kubernetes", "linux", "exploit", "containers", "docker", "container-escape", "cgroups", "privileged-containers"]
phying_url: "https://phying.com/item/1940"
lang: en
---

# Understanding Docker container escapes

## Summary

Breaks down Felix Wilhelm's cgroups release_agent container escape PoC: root plus SYS_ADMIN, no AppArmor, and writable cgroup v1 suffice—warning against --privileged Docker containers.

## Intelligence Metadata

- **Sources:** blog.trailofbits.com
- **Published:** 2019-07-20T01:01:09Z
- **Original:** https://blog.trailofbits.com/2019/07/19/understanding-docker-container-escapes/
- **Phying News:** https://phying.com/item/1940