31 Dec 2025
Containers DoorDasher’s DemiseContainer escape is a technique that enables code running inside a container to obtain rights or execute on the host kernel (or other containers) beyond its isolated environment. I.e., creating a priviledged container with internet access from a container that doesn’t have access.
Unix/runtime sockets accessed via API handle CLI and daemon traffic. If an attacker can communicate with the socket from inside a container it can be exploited.
Investigate the Docler layers and restore the original website.
docker ps - see services running inside Docker
docker exec -it <container-name> sh - enter a container in a shell?
ls -la /var/run/docker.sock - list full properties of that container’s Docker socket. Default practice is to not mount the socket to prevent malicious use, but test containers may need the access. Mounting it allows direct access to the API.
docker exec -it <container-name> bash - enter a container in bash
Container Vulnerabilities room