Post 88 - Sprint 2

31 Dec 2025

Day 14 Containers DoorDasher’s Demise

Escape Attack and Sockets

Container escape is a technique that enables code running inside a container to obtain rights or execute on the host kernel (or other containers) beyond its isolated environment. I.e., creating a priviledged container with internet access from a container that doesn’t have access.

Unix/runtime sockets accessed via API handle CLI and daemon traffic. If an attacker can communicate with the socket from inside a container it can be exploited.

The Task

Investigate the Docler layers and restore the original website.

Commands used

docker ps - see services running inside Docker
docker exec -it <container-name> sh - enter a container in a shell?
ls -la /var/run/docker.sock - list full properties of that container’s Docker socket. Default practice is to not mount the socket to prevent malicious use, but test containers may need the access. Mounting it allows direct access to the API.
docker exec -it <container-name> bash - enter a container in bash

Container Vulnerabilities room