Quick answer

LinPEAS detects several container runtimes (Docker, LXC, containerd), reports whether you are inside one, lists mounted tokens and writable bind mounts, and evaluates conditions that enable breaking out to the host.

What it detects#

  • Container context from cgroup, /.dockerenv, and environment signals.
  • Runtime tooling present (docker, runc, containerd, crictl).
  • Mounted service tokens and writable bind mounts without nosuid.
  • Capabilities and namespaces that weaken isolation.

Verify it yourself#

Reproduce container detection
cat /proc/1/cgroup
grep -qa container=lxc /proc/1/environ && echo 'LXC'
mount | grep -i 'bind'
Note

Container escalation has two goals: root inside the container, and breakout to the host. LinPEAS helps with both, but breakout depends on specific misconfigurations — verify before acting.

Sources & references

  1. linPEAS README
  2. PEASS-ng release — reviewed 20260908-dffb9496
  3. HackTricks: Linux privilege escalation