B3: Cloud, Containers & Kubernetes
Container Security Deep: Escapes, Images & Runtime Risk
How containers fail: privileged mode, mounts, sockets, capabilities, image secrets, and runtime boundaries.
A container is not a VM. It is a process with namespaces, cgroups, capabilities, seccomp/AppArmor/SELinux policy, filesystem mounts, and runtime configuration.
- Privileged containers and excessive Linux capabilities expand host-level reach.
- Docker socket mounts can give control over the host's container runtime.
- HostPath mounts may expose sensitive host files or writable directories.
- Image layers and environment variables often leak secrets.
- Weak seccomp/AppArmor/SELinux profiles remove important runtime guardrails.