Sharing the host IPC namespace (--ipc=host, Kubernetes hostIPC) gives the container the host's System V and POSIX IPC objects: shared memory segments, semaphores, and message queues. Processes that keep secrets or state in shared memory (some databases, caches, and agents) expose it to the container.
ipcs # host shared memory segments, queues, semaphores
# Attach to and dump a host shared-memory segment by its id
ipcs -m; cat /proc/sysvipc/shm
Exploitation notes#
- It is primarily an information and interference primitive, not a direct root escape: read secrets from shared memory or corrupt a host process's shared state.
- The value depends on what host software uses shared memory; pair it with Host PID namespace for a stronger foothold.
- POSIX shared memory also surfaces under
/dev/shm, which may be shared separately.