Critical ThreatCloud & Container SecurityCWE-269
Rootless Docker & Podman: Preventing Container Escapes
Harden your container environments using rootless Docker and Podman to prevent privilege escalation and container escapes.
Vulnerability Overview
Containers running as root allow escapes to host root.
Kernel exploits inside the container compromise the host.
Vulnerable Code
USER rootRuns processes as root.
Remediated Code
USER 1001Runs as non-root user.
Hardening Rules
- 1Run rootless
- 2Drop capabilities
- 3Read-only rootfs
Frequently Asked Questions
Is root inside container same as host root?
Yes, unless user namespaces are mapped.