Namespaces are what make a container a container: separate views of processes, network, IPC, mounts, users, and more. Every --pid=host, --net=host, --ipc=host, or --userns=host flag (and the Kubernetes hostPID, hostNetwork, hostIPC fields) removes one of those separations, re-joining the container to the host's view. None of these is a memory-corruption exploit; each simply hands back a slice of the host, and the escape is using that slice.
Fingerprint which namespaces are shared with the host by comparing namespace IDs against PID 1 on the host, or by what is visible:
ls -l /proc/self/ns/ # this process's namespace inode IDs
ls -l /proc/1/ns/ # compare: same inode = shared with host init
ls /proc | grep -E '^[0-9]+$' | wc -l # many host PIDs => shared PID namespace
ip addr; ss -tlnp 2>/dev/null | head # host interfaces/ports => shared net namespace
ipcs # host shared memory/semaphores => shared IPC
cat /proc/self/uid_map # "0 0 ..." => not in a user namespace
Subtopics#
- Host PID namespace: see and inject into host processes.
- Host network namespace: reach host-local services and intercept traffic.
- Host IPC namespace: read shared memory and message queues.
- Host user namespace: when container root maps to host root.