performing-container-escape-detection

通过分析命名空间配置、特权容器检查、危险能力分配和宿主机路径挂载，使用 kubernetes Python 客户端检测容器逃逸尝试。识别通过 cgroup 滥用的 CVE-2022-0492 类型逃逸。适用于审计容器安全态势或调查逃逸尝试。

9 stars

bykillvxk

View on GitHub Installation ↓

Best use case

performing-container-escape-detection is best used when you need a repeatable AI agent workflow instead of a one-off prompt.

Teams using performing-container-escape-detection should expect a more consistent output, faster repeated execution, less prompt rewriting.

When to use this skill

You want a reusable workflow that can be run more than once with consistent structure.

When not to use this skill

You only need a quick one-off answer and do not need a reusable workflow.
You cannot install or maintain the underlying files, dependencies, or repository context.

Installation

Claude Code / Cursor / Codex

$curl -o ~/.claude/skills/performing-container-escape-detection/SKILL.md --create-dirs "https://raw.githubusercontent.com/killvxk/cybersecurity-skills-zh/main/skills/performing-container-escape-detection/SKILL.md"

Manual Installation

Download SKILL.md from GitHub
Place it in .claude/skills/performing-container-escape-detection/SKILL.md inside your project
Restart your AI agent — it will auto-discover the skill

How performing-container-escape-detection Compares

Feature / Agent	performing-container-escape-detection	Standard Approach
Platform Support	Not specified	Limited / Varies
Context Awareness	High	Baseline
Installation Complexity	Unknown	N/A

Frequently Asked Questions

What does this skill do?

Where can I find the source code?

You can find the source code on GitHub using the link provided at the top of the page.

SKILL.md Source

# 执行容器逃逸检测

## 说明

审计 Kubernetes Pod 的容器逃逸向量，包括特权模式（Privileged Mode）、危险能力（Dangerous Capabilities）、宿主机命名空间共享和可写的 hostPath 挂载。

```python
from kubernetes import client, config
config.load_kube_config()
v1 = client.CoreV1Api()

pods = v1.list_pod_for_all_namespaces()
for pod in pods.items:
    for container in pod.spec.containers:
        sc = container.security_context
        if sc and sc.privileged:
            print(f"特权容器: {pod.metadata.namespace}/{pod.metadata.name}")
```

主要逃逸向量：
1. 特权容器（完整宿主机访问权限）
2. CAP_SYS_ADMIN 能力
3. 宿主机 PID/网络/IPC 命名空间共享
4. 对 / 或 /etc 的可写 hostPath 挂载
5. Docker socket 挂载（/var/run/docker.sock）

## 示例

```python
# 检查 Docker socket 挂载
for vol in pod.spec.volumes or []:
    if vol.host_path and "docker.sock" in (vol.host_path.path or ""):
        print(f"暴露的 Docker socket：{pod.metadata.name}")
```

Related Skills

securing-container-registry-with-harbor

from killvxk/cybersecurity-skills-zh

Harbor 是一个开源容器镜像仓库，提供安全功能包括漏洞扫描（集成 Trivy）、镜像签名（Notary/Cosign）、RBAC、内容信任策略（Content Trust）、复制和审计日志。配置这些功能以强制执行镜像来源验证、防止有漏洞镜像部署并维护仓库访问控制。

securing-container-registry-images

from killvxk/cybersecurity-skills-zh

通过使用 Trivy 和 Grype 实施漏洞扫描、使用 Cosign 和 Sigstore 强制执行镜像签名、配置镜像仓库访问控制，以及构建阻止部署未扫描或未签名镜像的 CI/CD 流水线，来保护容器仓库（Container Registry）中的镜像安全。

scanning-containers-with-trivy-in-cicd

from killvxk/cybersecurity-skills-zh

本技能涵盖将 Aqua Security 的 Trivy 扫描器集成到 CI/CD 流水线中，用于全面的容器镜像漏洞检测。包括扫描 Docker 镜像中的操作系统包和应用依赖 CVE、检测 Dockerfile 中的错误配置、扫描文件系统和 Git 仓库，以及建立基于严重性的质量门禁以阻止有漏洞的镜像部署。