About
In this module of the Docker Security learning path, you switch from the defender role to the attacker. The previous three modules covered what containers should look like when they are configured correctly. This module covers offensive container hacking: what happens when containers are misconfigured and how an attacker chains application vulnerabilities into host-level compromise. You start with an unauthenticated web application running inside a container on the Ciberbots nested Docker lab host and chain a command injection foothold into three different container escape paths: a Docker socket mount that gives you full control of the nested engine, a privileged container whose elevated capabilities let you mount the nested host filesystem, and a capability-granted container that demonstrates CAP_SYS_ADMIN abuse. You also study a kernel escape CVE class (Dirty Pipe, runc breakouts) through static analysis, not a live exploit, so you understand the risk without running uncontrolled code in the lab. Every escape in this module targets the nested Docker lab host (`docker-lab`). That host is a `docker:dind` container running its own daemon. Any breakout you achieve lands on the dind filesystem, not the underlying LXC host and not the Proxmox infrastructure. The flags you recover are files planted at `/opt/mds/` inside the nested Docker host. Upon completion of the module, students will be able to: • Describe a structured methodology for container penetration testing and enumerate the attack surface of a Docker environment. • Exploit a command injection vulnerability in a containerized web application to obtain a shell inside the container. • Escape a container through a mounted Docker socket to gain control of the nested Docker host. • Abuse a privileged container and a container with excessive Linux capabilities to read files on the nested Docker host filesystem. • Analyse kernel-level container escape CVEs and articulate the conditions under which they apply. Skills: `container-pt-method`, `container-foothold`, `userspace-escape`, `cap-abuse-case-study` Prerequisites: Docker Security Foundations, Docker Runtime Security and Hardening, Secure Delivery and Supply Chain, or equivalent Docker CLI, compose, and runtime hardening experience. Certifications aligned: OWASP Docker Top 10 (D01, secure user mapping; D06, container escape), MITRE ATT&CK Containers (T1611, escape to host), CIS Docker Benchmark §5 (container runtime), NIST SP 800-190 §4.3 (container runtime threats). For inquiries, please write us at https://www.darkrelay.com/cybersecurity-course-inquiry