LinPEAS in Docker: Detection & Breakout Checks

Running LinPEAS inside Docker

By LinPEAS Guide Editorial TeamReviewed by Security Review DeskLast reviewed 2026-09-131 min read

Quick answer

Inside a Docker container, LinPEAS detects the container context and looks for breakout conditions: a mounted Docker socket, the --privileged flag, dangerous capabilities (like CAP_SYS_ADMIN), sensitive host mounts and shared host namespaces.

What LinPEAS flags in a container#

A mounted /var/run/docker.sock — often a one-step breakout to host root.
--privileged mode and dangerous effective capabilities.
Host filesystem paths mounted into the container.
Mounted service-account tokens (also relevant in Kubernetes).

docker output (illustrative)

╔══════════╣ Container & breakout enumeration
Looks like you are inside a Docker container
/var/run/docker.sock is mounted!
CapEff includes cap_sys_admin

Verify it yourself#

Reproduce container/breakout checks

cat /proc/1/cgroup
ls -la /.dockerenv /var/run/docker.sock 2>/dev/null
cat /proc/self/status | grep CapEff

Read the concepts behind this: containers and namespaces.

Sources & references

linPEAS README
PEASS-ng release — reviewed 20260908-dffb9496
HackTricks: Linux privilege escalation