Container & VM Escape Techniques

You have code execution inside a Docker container or other containerized environment during an authorized penetration test. Reason through escape vectors.

**Situational Awareness**
- How do you detect that you are inside a container? (/.dockerenv, cgroup, hostname patterns)
- What does the container's mount table and network configuration reveal?
- How do you identify the host OS and kernel version from inside a container?

**Docker Socket Escape**
- What is the Docker socket (/var/run/docker.sock) and why is mounting it inside a container a critical vulnerability?
- How do you use the Docker socket to spawn a privileged container with host filesystem access?
- What is the Docker socket attack chain from container code execution to full host root?

**Privileged Container Escape**
- What does `--privileged` give a Docker container?
- How do you use `--privileged` to mount the host filesystem or access host devices?
- What is the cgroup release_agent escape and how does it work without --privileged but with specific capabilities?

**Capability Abuse**
- What Linux capabilities, if assigned to a container, enable escape? (CAP_SYS_ADMIN, CAP_SYS_PTRACE, CAP_NET_ADMIN)
- How does CAP_SYS_ADMIN enable a container escape via cgroup v1?
- How does CAP_SYS_PTRACE enable process injection into host processes?

**Shared Namespace Escape**
- What happens when a container shares the host PID, network, or IPC namespace?
- How do you use shared PID namespace to access host processes?

Output:
- Container escape decision tree
- Docker socket exploit chain commands
- Capability-based escape techniques