section // posts
/topics/cloud-security

Cloud security

Server-side reachability, workload identity, effective IAM permissions, and the paths that connect them.

1 posts0 CVE analysesAll topics
Full topic archive

Every matching record.

Methods and named-vulnerability research remain visually and editorially separate.

Field notes 1

Cloud Security · Nov 6, 2026

Container Escape: Docker Socket, Privileged Mode, and the Boundary That Moves

A container is a namespace, a cgroup, and a set of capabilities — not a boundary. When one of those is handed to you, the host is a mount away. The Docker socket and --privileged are demonstrated live, and the cgroup v1 trick that modern systems already killed is called out.

6 min read ↗