Under Kubernetes, the container that runs a pod is created not by Docker but by containerd or CRI-O, invoked by the kubelet over the Container Runtime Interface. Their offensive surface mirrors Docker's but is node-scoped: a reachable control socket is root-equivalent on the node, their clients enumerate every container, image, and task on the node, and the credentials they cache for pulling images unlock private registries.
Detect which runtime a node uses and find its socket:
ls -l /run/containerd/containerd.sock /run/crio/crio.sock /var/run/crio/crio.sock 2>/dev/null
crictl --runtime-endpoint unix:///run/containerd/containerd.sock version 2>/dev/null
ps -ef | grep -E 'containerd|crio' | grep -v grep | head
Subtopics#
- containerd socket: node-level container control through the containerd socket.
- CRI-O socket: the same through the CRI-O socket.
- crictl and ctr enumeration: mapping the node with the runtime clients.
- Image pull secret theft: stealing the registry credentials the runtime uses.