Quick answer

A container is an isolated process (or group) using namespaces and cgroups to get its own view of the system while sharing the host kernel. Inside a container, privilege escalation can mean gaining root in the container, or the more serious goal of breaking out to the host.

What is Containers?#

Unlike a VM, a container shares the host kernel. Docker, Podman, LXC and containerd are common runtimes. Isolation comes from namespaces, cgroups, dropped capabilities, and optional seccomp/AppArmor/SELinux confinement — not from a hardware boundary.

Why LinPEAS checks containers#

LinPEAS detects container context (Docker/LXC/containerd), lists mounted service tokens, checks capabilities and mounts, and flags conditions that enable breakout, because the escalation goals differ inside a container.

What a normal configuration looks like#

A well-configured container runs unprivileged, with user-namespace remapping, minimal capabilities, no host mounts, and no access to the Docker socket.

Why it can be security-sensitive#

Breakout enablers include: the --privileged flag, a mounted Docker socket (/var/run/docker.sock), the host filesystem mounted inside, dangerous capabilities (CAP_SYS_ADMIN), shared host namespaces, and writable cgroup release-agent paths.

From highlight to verdict

Understanding the concept tells you whether a LinPEAS highlight is a real problem here. The tool flags candidates; you confirm exploitability in context, and only act where authorised.

How to check it manually#

Run these read-only commands to inspect this area yourself and validate what LinPEAS reports:

Am I in a container?
cat /proc/1/cgroup; ls -la /.dockerenv 2>/dev/null
Mounted Docker socket?
ls -la /var/run/docker.sock 2>/dev/null
My capabilities
cat /proc/self/status | grep CapEff

Defensive remediation#

  • Run containers unprivileged with user-namespace remapping.
  • Never mount the Docker socket into untrusted containers.
  • Drop all capabilities and add back only what is needed.
  • Avoid mounting sensitive host paths; apply seccomp/AppArmor profiles.

Sources & references

  1. HackTricks: Linux privilege escalation
  2. GTFOBins — abuse techniques for standard binaries
  3. PEASS-ng repository — reviewed 20260908-dffb9496