Container escape-check is a shell script designed to identify vulnerabilities that could allow a process running inside a Docker container to escape its confines. It examines common misconfigurations and exploits, such as privileged mode, socket mounting, and directory access. By executing this script, users can proactively assess their container's security posture and mitigate potential escape risks using a straightforward command.
The script provides a comprehensive set of checks for common container escape vulnerabilities, including DirtyCow, DirtyPipe, and various CVEs. It is designed to be easily integrated into container security workflows. The script's simplicity makes it suitable for quick security assessments. The recent addition of automatic capsh installation enhances detection for capabilities-based exploits.
- Privileged Mode Detection: Identifies containers running with elevated privileges, increasing the potential for escape.
- Socket Mounting Check: Verifies if the Docker socket is mounted within the container, enabling control over the Docker daemon.
- Host Directory Access: Checks for mounts of sensitive host directories like /proc, /root, and /etc, facilitating access to system information.
- Remote API Detection: Detects if the Docker Remote API is exposed, allowing external control of the container.
- CVE Vulnerability Scans: Includes checks for several known container escape vulnerabilities including DirtyCow, DirtyPipe, and various CVEs.
- Automated capsh Installation: Automatically installs the capsh command if it's missing, streamlining certain vulnerability checks.
- Enhanced Detection: Improved detection methods implemented in recent versions, increasing accuracy and coverage.
The project is actively maintained, with recent updates addressing new vulnerabilities and improving detection accuracy. The README includes notes about potential false positives and omissions, encouraging community feedback. The script's focus on practical checks and straightforward usage suggests a reasonable level of reliability, though further testing and validation might be beneficial for critical deployments.
Container escape-check benefits developers and security professionals by providing a practical tool for identifying container escape vulnerabilities. It aids in proactively hardening container configurations and reducing the risk of container breakout exploits. It's particularly valuable for teams seeking a simple, command-line solution for vulnerability assessment, allowing for quick identification of high-risk configurations before deployment or during security audits.