Cloud SecurityNov 6, 20266 min read
Container Escape: Docker Socket, Privileged Mode, and the Boundary That Moves
A container is a namespace, a cgroup, and a set of capabilities — not a boundary. When one of those is handed to you, the host is a mount away. The Docker socket and --privileged are demonstrated live, and the cgroup v1 trick that modern systems already killed is called out.
