<!DOCTYPE HTML>
<html lang="en" class="hacktricks-light sidebar-visible" dir="ltr">
    <head>
        <!-- Book generated using mdBook -->
        <meta charset="UTF-8">
        <title>Docker --privileged - HackTricks</title>

        <!-- Custom HTML head -->

        <meta name="description" content="">
        <meta name="viewport" content="width=device-width, initial-scale=1">
        <meta name="theme-color" content="#ffffff">

        <link rel="icon" href="../../../favicon.svg">
        <link rel="shortcut icon" href="../../../favicon.png">
        <link rel="stylesheet" href="../../../css/variables.css">
        <link rel="stylesheet" href="../../../css/general.css">
        <link rel="stylesheet" href="../../../css/chrome.css">

        <!-- Fonts -->
        <link rel="stylesheet" href="../../../FontAwesome/css/font-awesome.css">
        <link rel="stylesheet" href="../../../fonts/fonts.css">

        <!-- Highlight.js Stylesheets -->
        <link rel="stylesheet" href="../../../highlight.css">
        <link rel="stylesheet" href="../../../tomorrow-night.css">
        <link rel="stylesheet" href="../../../ayu-highlight.css">

        <!-- Custom theme stylesheets -->
        <link rel="stylesheet" href="../../../theme/pagetoc.css">
        <link rel="stylesheet" href="../../../theme/tabs.css">


        <!-- Provide site root to javascript -->
        <script>
            var path_to_root = "../../../";
            var lang = "en";
            var default_theme = window.matchMedia("(prefers-color-scheme: dark)").matches ? "hacktricks-dark" : "hacktricks-light";
        </script>
        <!-- Start loading toc.js asap -->
        <script src="../../../toc.js"></script>
    </head>
    <body>
    <div id="body-container">
        <!-- Work around some values being stored in localStorage wrapped in quotes -->
        <script>
            try {
                var theme = localStorage.getItem('mdbook-theme');
                var sidebar = localStorage.getItem('mdbook-sidebar');

                if (theme.startsWith('"') && theme.endsWith('"')) {
                    localStorage.setItem('mdbook-theme', theme.slice(1, theme.length - 1));
                }

                if (sidebar.startsWith('"') && sidebar.endsWith('"')) {
                    localStorage.setItem('mdbook-sidebar', sidebar.slice(1, sidebar.length - 1));
                }
            } catch (e) { }
        </script>

        <!-- Set the theme before any content is loaded, prevents flash -->
        <script>
            var theme;
            try { theme = localStorage.getItem('mdbook-theme'); } catch(e) { }
            if (theme === null || theme === undefined) { theme = default_theme; }
            const html = document.documentElement;
            html.classList.remove('hacktricks-light')
            html.classList.add(theme);
            html.classList.add("js");
        </script>

        <input type="checkbox" id="sidebar-toggle-anchor" class="hidden">

        <!-- Hide / unhide sidebar before it is displayed -->
        <script>
            var sidebar = null;
            var sidebar_toggle = document.getElementById("sidebar-toggle-anchor");
            var body = document.querySelector("body");
            if (document.body.clientWidth >= 550) {
                try { sidebar = localStorage.getItem('mdbook-sidebar'); } catch(e) { }
                sidebar = sidebar || 'visible';
            } else {
                sidebar = 'hidden';
            }
            sidebar_toggle.checked = sidebar === 'visible';
            html.classList.remove('sidebar-visible');
            html.classList.add("sidebar-" + sidebar);
            body.classList.remove('sidebar-visible');
            body.classList.add("sidebar-" + sidebar);
        </script>

        <div id="page-wrapper" class="page-wrapper">
            <div id="search-wrapper" class="hidden">
                <div id="search-modal">
                    <form id="searchbar-outer" class="searchbar-outer">
                        <span class="fa fa-search"></span>
                        <input type="search" id="searchbar" name="searchbar" placeholder="Search this book ..." aria-controls="searchresults-outer" aria-describedby="searchresults-header">
                    </form>
                    <div id="searchresults-outer" class="searchresults-outer hidden">
                        <div id="searchresults-header" class="searchresults-header"></div>
                        <ul id="searchresults">
                        </ul>
                    </div>
                </div>
            </div>

            <div class="page">
                <div id="menu-bar-hover-placeholder"></div>
                <div id="menu-bar" class="menu-bar sticky">
                    <div class="menu-bar-container">
                        <div class="left-buttons">
                            <label id="sidebar-toggle" class="icon-button" for="sidebar-toggle-anchor" title="Toggle Table of Contents" aria-label="Toggle Table of Contents" aria-controls="sidebar">
                                <i class="fa fa-bars"></i>
                            </label>
                            <a href="/">
                                <h1 class="menu-title"><img src="../../../../../images/CLOUD-web-logo.png" alt="" style="width:auto;height:30px;vertical-align:middle;margin-right:5px;">HackTricks</h1>
                            </a>

                        </div>


                        <div class="right-buttons">
                            <div id="menubar-collapse">
                                <a class="menu-bar-link" href="https://training.hacktricks.xyz" target="_blank">
                                    Hacktricks Training
                                </a>
                                <a class="menu-bar-link" href="https://twitter.com/hacktricks_live" target="_blank">
                                    Twitter
                                </a>
                                <a class="menu-bar-link" href="https://www.linkedin.com/company/hacktricks" target="_blank">
                                    Linkedin
                                </a>
                                <a class="menu-bar-link" href="https://github.com/sponsors/carlospolop" target="_blank">
                                    Sponsor
                                </a>
                            </div>
                            <div class="icons">
                                <div id="menubar-collapse-toggle" class="icon-button" type="button" title="Toggle menu bar" aria-label="Toggle Menu bar" aria-expanded="false" aria-controls="collapse">
                                    <i class="fa fa-ellipsis-h"></i>
                                    <div id="menubar-collapse-popup" class="menubar-collapse-popup" aria-label="Menu" role="menu">
                                        <a href="https://training.hacktricks.xyz" target="_blank" role="menuitem" class="menu-bar-link">Hacktricks Training</a>
                                        <a href="https://twitter.com/hacktricks_live" target="_blank" role="menuitem" class="menu-bar-link">Twitter</a>
                                        <a href="https://www.linkedin.com/company/hacktricks" target="_blank" role="menuitem" class="menu-bar-link">Linkedin</a>
                                        <a href="https://github.com/sponsors/carlospolop" target="_blank" role="menuitem" class="menu-bar-link">Sponsor</a>
                                    </div>
                                </div>

                                <button id="search-toggle" class="icon-button" type="button" title="Search. (Shortkey: s)" aria-label="Toggle Searchbar" aria-expanded="false" aria-keyshortcuts="S" aria-controls="searchbar">
                                    <i class="fa fa-search"></i>
                                </button>

                                <div id="menubar-languages-toggle" class="icon-button" type="button" title="Translations" aria-label="Toggle Tanslations" aria-expanded="false" aria-controls="translations">
                                    <i class="fa fa-globe"></i>
                                    <span class="menu-bar-link">Translations</span>
                                    
                                    <div id="menubar-languages-popup" class="menubar-languages-popup" aria-label="Language menu" role="language menu">
                                        <button id="af" role="menuitem" class="menu-bar-link">Afrikaans</button>
                                        <button id="zh" role="menuitem" class="menu-bar-link">Chinese</button>
                                        <button id="en" role="menuitem" class="menu-bar-link">English</button>
                                        <button id="fr" role="menuitem" class="menu-bar-link">French</button>
                                        <button id="de" role="menuitem" class="menu-bar-link">German</button>
                                        <button id="el" role="menuitem" class="menu-bar-link">Greek</button>
                                        <button id="hi" role="menuitem" class="menu-bar-link">Hindi</button>
                                        <button id="it" role="menuitem" class="menu-bar-link">Italian</button>
                                        <button id="ja" role="menuitem" class="menu-bar-link">Japanese</button>
                                        <button id="ko" role="menuitem" class="menu-bar-link">Korean</button>
                                        <button id="pl" role="menuitem" class="menu-bar-link">Polish</button>
                                        <button id="pt" role="menuitem" class="menu-bar-link">Portuguese</button>
                                        <button id="sr" role="menuitem" class="menu-bar-link">Serbian</button>
                                        <button id="es" role="menuitem" class="menu-bar-link">Spanish</button>
                                        <button id="sw" role="menuitem" class="menu-bar-link">Swahili</button>
                                        <button id="tr" role="menuitem" class="menu-bar-link">Turkish</button>
                                        <button id="uk" role="menuitem" class="menu-bar-link">Ukrainian</button>
                                    </div>
                                </div>
                            </div>


                        </div>
                    </div>
                </div>
                <div id="container" class="container">
                    <nav id="sidebar" class="sidebar" aria-label="Table of contents">
                        <!-- populated by js -->
                        <mdbook-sidebar-scrollbox class="sidebar-scrollbox"></mdbook-sidebar-scrollbox>
                        <noscript>
                            <iframe class="sidebar-iframe-outer" src="../../../toc.html"></iframe>
                        </noscript>
                    </nav>
                    <!-- Apply ARIA attributes after the sidebar and the sidebar toggle button are added to the DOM -->
                    <script>
                        document.getElementById('sidebar-toggle').setAttribute('aria-expanded', sidebar === 'visible');
                        document.getElementById('sidebar').setAttribute('aria-hidden', sidebar !== 'visible');
                        Array.from(document.querySelectorAll('#sidebar a')).forEach(function(link) {
                            link.setAttribute('tabIndex', sidebar === 'visible' ? 0 : -1);
                        });
                    </script>

                    <div id="content" class="content">
                        <main>
                            <div class="mobilesponsor-wrapper">

                            <a class="mobilesponsor" href="" target="_blank">
                                <img src="" alt="" srcset="">
                                <div class="mobilesponsor-title">
                                </div>
                                <div class="mobilesponsor-description">
                                </div>
                                <div class="mobilesponsor-cta"></div>
                            </a>
                            </div>
                            <h1 id="docker---privileged"><a class="header" href="#docker---privileged">Docker --privileged</a></h1>
<blockquote>
<p>[!TIP]
Learn &amp; practice AWS Hacking:<img src="../../../../../images/arte.png" alt="" style="width:auto;height:24px;vertical-align:middle;"><a href="https://training.hacktricks.xyz/courses/arte"><strong>HackTricks Training AWS Red Team Expert (ARTE)</strong></a><img src="../../../../../images/arte.png" alt="" style="width:auto;height:24px;vertical-align:middle;"><br />
Learn &amp; practice GCP Hacking: <img src="../../../../../images/grte.png" alt="" style="width:auto;height:24px;vertical-align:middle;"><a href="https://training.hacktricks.xyz/courses/grte"><strong>HackTricks Training GCP Red Team Expert (GRTE)</strong></a><img src="../../../../../images/grte.png" alt="" style="width:auto;height:24px;vertical-align:middle;"></p>
<details>
<summary>Support HackTricks</summary>
<ul>
<li>Check the <a href="https://github.com/sponsors/carlospolop"><strong>subscription plans</strong></a>!</li>
<li><strong>Join the</strong> 💬 <a href="https://discord.gg/hRep4RUj7f"><strong>Discord group</strong></a> or the <a href="https://t.me/peass"><strong>telegram group</strong></a> or <strong>follow</strong> us on <strong>Twitter</strong> 🐦 <a href="https://twitter.com/hacktricks_live"><strong>@hacktricks_live</strong></a><strong>.</strong></li>
<li><strong>Share hacking tricks by submitting PRs to the</strong> <a href="https://github.com/carlospolop/hacktricks"><strong>HackTricks</strong></a> and <a href="https://github.com/carlospolop/hacktricks-cloud"><strong>HackTricks Cloud</strong></a> github repos.</li>
</ul>
</details>
</blockquote>
<h2 id="what-affects"><a class="header" href="#what-affects">What Affects</a></h2>
<p>When you run a container as privileged these are the protections you are disabling:</p>
<h3 id="mount-dev"><a class="header" href="#mount-dev">Mount /dev</a></h3>
<p>In a privileged container, all the <strong>devices can be accessed in <code>/dev/</code></strong>. Therefore you can <strong>escape</strong> by <strong>mounting</strong> the disk of the host.</p>
<p>{{#tabs}}
{{#tab name="Inside default container"}}</p>
<pre><code class="language-bash"># docker run --rm -it alpine sh
ls /dev
console  fd       mqueue   ptmx     random   stderr   stdout   urandom
core     full     null     pts      shm      stdin    tty      zero
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="Inside Privileged Container"}}</p>
<pre><code class="language-bash"># docker run --rm --privileged -it alpine sh
ls /dev
cachefiles       mapper           port             shm              tty24            tty44            tty7
console          mem              psaux            stderr           tty25            tty45            tty8
core             mqueue           ptmx             stdin            tty26            tty46            tty9
cpu              nbd0             pts              stdout           tty27            tty47            ttyS0
[...]
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<h3 id="read-only-kernel-file-systems"><a class="header" href="#read-only-kernel-file-systems">Read-only kernel file systems</a></h3>
<p>Kernel file systems provide a mechanism for a process to modify the behavior of the kernel. However, when it comes to container processes, we want to prevent them from making any changes to the kernel. Therefore, we mount kernel file systems as <strong>read-only</strong> within the container, ensuring that the container processes cannot modify the kernel.</p>
<p>{{#tabs}}
{{#tab name="Inside default container"}}</p>
<pre><code class="language-bash"># docker run --rm -it alpine sh
mount | grep '(ro'
sysfs on /sys type sysfs (ro,nosuid,nodev,noexec,relatime)
cpuset on /sys/fs/cgroup/cpuset type cgroup (ro,nosuid,nodev,noexec,relatime,cpuset)
cpu on /sys/fs/cgroup/cpu type cgroup (ro,nosuid,nodev,noexec,relatime,cpu)
cpuacct on /sys/fs/cgroup/cpuacct type cgroup (ro,nosuid,nodev,noexec,relatime,cpuacct)
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="Inside Privileged Container"}}</p>
<pre><code class="language-bash"># docker run --rm --privileged -it alpine sh
mount  | grep '(ro'
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<h3 id="masking-over-kernel-file-systems"><a class="header" href="#masking-over-kernel-file-systems">Masking over kernel file systems</a></h3>
<p>The <strong>/proc</strong> file system is selectively writable but for security, certain parts are shielded from write and read access by overlaying them with <strong>tmpfs</strong>, ensuring container processes can't access sensitive areas.</p>
<blockquote>
<p>[!NOTE] &gt; <strong>tmpfs</strong> is a file system that stores all the files in virtual memory. tmpfs doesn't create any files on your hard drive. So if you unmount a tmpfs file system, all the files residing in it are lost for ever.</p>
</blockquote>
<p>{{#tabs}}
{{#tab name="Inside default container"}}</p>
<pre><code class="language-bash"># docker run --rm -it alpine sh
mount  | grep /proc.*tmpfs
tmpfs on /proc/acpi type tmpfs (ro,relatime)
tmpfs on /proc/kcore type tmpfs (rw,nosuid,size=65536k,mode=755)
tmpfs on /proc/keys type tmpfs (rw,nosuid,size=65536k,mode=755)
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="Inside Privileged Container"}}</p>
<pre><code class="language-bash"># docker run --rm --privileged -it alpine sh
mount  | grep /proc.*tmpfs
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<h3 id="linux-capabilities"><a class="header" href="#linux-capabilities">Linux capabilities</a></h3>
<p>Container engines launch the containers with a <strong>limited number of capabilities</strong> to control what goes on inside of the container by default. <strong>Privileged</strong> ones have <strong>all</strong> the <strong>capabilities</strong> accesible. To learn about capabilities read:</p>
<p><a class="content_ref" href="../linux-capabilities.html"><span class="content_ref_label">Linux Capabilities</span></a></p>
<p>{{#tabs}}
{{#tab name="Inside default container"}}</p>
<pre><code class="language-bash"># docker run --rm -it alpine sh
apk add -U libcap; capsh --print
[...]
Current: cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap=eip
Bounding set =cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap
[...]
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="Inside Privileged Container"}}</p>
<pre><code class="language-bash"># docker run --rm --privileged -it alpine sh
apk add -U libcap; capsh --print
[...]
Current: =eip cap_perfmon,cap_bpf,cap_checkpoint_restore-eip
Bounding set =cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read
[...]
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<p>You can manipulate the capabilities available to a container without running in <code>--privileged</code> mode by using the <code>--cap-add</code> and <code>--cap-drop</code> flags.</p>
<h3 id="seccomp"><a class="header" href="#seccomp">Seccomp</a></h3>
<p><strong>Seccomp</strong> is useful to <strong>limit</strong> the <strong>syscalls</strong> a container can call. A default seccomp profile is enabled by default when running docker containers, but in privileged mode it is disabled. Learn more about Seccomp here:</p>
<p><a class="content_ref" href="seccomp.html"><span class="content_ref_label">Seccomp</span></a></p>
<p>{{#tabs}}
{{#tab name="Inside default container"}}</p>
<pre><code class="language-bash"># docker run --rm -it alpine sh
grep Seccomp /proc/1/status
Seccomp:	2
Seccomp_filters:	1
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="Inside Privileged Container"}}</p>
<pre><code class="language-bash"># docker run --rm --privileged -it alpine sh
grep Seccomp /proc/1/status
Seccomp:	0
Seccomp_filters:	0
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<pre><code class="language-bash"># You can manually disable seccomp in docker with
--security-opt seccomp=unconfined
</code></pre>
<p>Also, note that when Docker (or other CRIs) are used in a <strong>Kubernetes</strong> cluster, the <strong>seccomp filter is disabled by default</strong></p>
<h3 id="apparmor"><a class="header" href="#apparmor">AppArmor</a></h3>
<p><strong>AppArmor</strong> is a kernel enhancement to confine <strong>containers</strong> to a <strong>limited</strong> set of <strong>resources</strong> with <strong>per-program profiles</strong>. When you run with the <code>--privileged</code> flag, this protection is disabled.</p>
<p><a class="content_ref" href="apparmor.html"><span class="content_ref_label">AppArmor</span></a></p>
<pre><code class="language-bash"># You can manually disable seccomp in docker with
--security-opt apparmor=unconfined
</code></pre>
<h3 id="selinux"><a class="header" href="#selinux">SELinux</a></h3>
<p>Running a container with the <code>--privileged</code> flag disables <strong>SELinux labels</strong>, causing it to inherit the label of the container engine, typically <code>unconfined</code>, granting full access similar to the container engine. In rootless mode, it uses <code>container_runtime_t</code>, while in root mode, <code>spc_t</code> is applied.</p>
<p><a class="content_ref" href="../selinux.html"><span class="content_ref_label">SELinux</span></a></p>
<pre><code class="language-bash"># You can manually disable selinux in docker with
--security-opt label:disable
</code></pre>
<h2 id="what-doesnt-affect"><a class="header" href="#what-doesnt-affect">What Doesn't Affect</a></h2>
<h3 id="namespaces"><a class="header" href="#namespaces">Namespaces</a></h3>
<p>Namespaces are <strong>NOT affected</strong> by the <code>--privileged</code> flag. Even though they don't have the security constraints enabled, they <strong>do not see all of the processes on the system or the host network, for example</strong>. Users can disable individual namespaces by using the <strong><code>--pid=host</code>, <code>--net=host</code>, <code>--ipc=host</code>, <code>--uts=host</code></strong> container engines flags.</p>
<p>{{#tabs}}
{{#tab name="Inside default privileged container"}}</p>
<pre><code class="language-bash"># docker run --rm --privileged -it alpine sh
ps -ef
PID   USER     TIME  COMMAND
    1 root      0:00 sh
   18 root      0:00 ps -ef
</code></pre>
<p>{{#endtab}}</p>
<p>{{#tab name="Inside --pid=host Container"}}</p>
<pre><code class="language-bash"># docker run --rm --privileged --pid=host -it alpine sh
ps -ef
PID   USER     TIME  COMMAND
    1 root      0:03 /sbin/init
    2 root      0:00 [kthreadd]
    3 root      0:00 [rcu_gp]ount | grep /proc.*tmpfs
[...]
</code></pre>
<p>{{#endtab}}
{{#endtabs}}</p>
<h3 id="user-namespace"><a class="header" href="#user-namespace">User namespace</a></h3>
<p><strong>By default, container engines don't utilize user namespaces, except for rootless containers</strong>, which require them for file system mounting and using multiple UIDs. User namespaces, integral for rootless containers, cannot be disabled and significantly enhance security by restricting privileges.</p>
<h2 id="references"><a class="header" href="#references">References</a></h2>
<ul>
<li><a href="https://www.redhat.com/sysadmin/privileged-flag-container-engines">https://www.redhat.com/sysadmin/privileged-flag-container-engines</a></li>
</ul>
<blockquote>
<p>[!TIP]
Learn &amp; practice AWS Hacking:<img src="../../../../../images/arte.png" alt="" style="width:auto;height:24px;vertical-align:middle;"><a href="https://training.hacktricks.xyz/courses/arte"><strong>HackTricks Training AWS Red Team Expert (ARTE)</strong></a><img src="../../../../../images/arte.png" alt="" style="width:auto;height:24px;vertical-align:middle;"><br />
Learn &amp; practice GCP Hacking: <img src="../../../../../images/grte.png" alt="" style="width:auto;height:24px;vertical-align:middle;"><a href="https://training.hacktricks.xyz/courses/grte"><strong>HackTricks Training GCP Red Team Expert (GRTE)</strong></a><img src="../../../../../images/grte.png" alt="" style="width:auto;height:24px;vertical-align:middle;"></p>
<details>
<summary>Support HackTricks</summary>
<ul>
<li>Check the <a href="https://github.com/sponsors/carlospolop"><strong>subscription plans</strong></a>!</li>
<li><strong>Join the</strong> 💬 <a href="https://discord.gg/hRep4RUj7f"><strong>Discord group</strong></a> or the <a href="https://t.me/peass"><strong>telegram group</strong></a> or <strong>follow</strong> us on <strong>Twitter</strong> 🐦 <a href="https://twitter.com/hacktricks_live"><strong>@hacktricks_live</strong></a><strong>.</strong></li>
<li><strong>Share hacking tricks by submitting PRs to the</strong> <a href="https://github.com/carlospolop/hacktricks"><strong>HackTricks</strong></a> and <a href="https://github.com/carlospolop/hacktricks-cloud"><strong>HackTricks Cloud</strong></a> github repos.</li>
</ul>
</details>
</blockquote>

                        </main>

                        <nav class="nav-wrapper" aria-label="Page navigation">
                            <!-- Mobile navigation buttons -->
                                <a rel="prev" href="../../../linux-hardening/privilege-escalation/docker-security/cgroups.html" class="mobile-nav-chapters previous" title="Previous chapter" aria-label="Previous chapter" aria-keyshortcuts="Left">
                                    <i class="fa fa-angle-left"></i>
                                </a>

                                <a rel="next prefetch" href="../../../linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/index.html" class="mobile-nav-chapters next" title="Next chapter" aria-label="Next chapter" aria-keyshortcuts="Right">
                                    <i class="fa fa-angle-right"></i>
                                </a>

                            <div style="clear: both"></div>
                        </nav>

                        <nav class="nav-wide-wrapper" aria-label="Page navigation">
                                <a rel="prev" href="../../../linux-hardening/privilege-escalation/docker-security/cgroups.html" class="nav-chapters previous" title="Previous chapter" aria-label="Previous chapter" aria-keyshortcuts="Left">
                                    <i class="fa fa-angle-left"></i><span style="font-size: medium; align-self: center; margin-left: 10px;">CGroups</span>
                                </a>

                                <a rel="next prefetch" href="../../../linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/index.html" class="nav-chapters next" title="Next chapter" aria-label="Next chapter" aria-keyshortcuts="Right">
                                    <span style="font-size: medium; align-self: center; margin-right: 10px;">Docker Breakout / Privilege Escalation</span><i class="fa fa-angle-right"></i>
                                </a>
                        </nav>
                    </div>

                    <div class="sidetoc">
                        <div class="sidetoc-wrapper">
                            <nav class="pagetoc"></nav>
                            <a class="sidesponsor" href="" target="_blank">
                                <img src="" alt="" srcset="">
                                <div class="sponsor-title">
                                </div>
                                <div class="sponsor-description">
                                </div>
                                <div class="sponsor-cta"></div>
                            </a>
                        </div>
                    </div>
                </div>
                <div class="footer">
                    <div id="theme-wrapper" class="theme-wrapper">
                        <div id="theme-btns" class="theme-btns">
                            <button id="hacktricks-light" type="button" role="radio" aria-label="Switch to light theme" aria-checked="false" class="theme">
                                <i class="fa fa-sun-o"></i>
                            </button>
                            <button id="hacktricks-dark" type="button" role="radio" aria-label="Switch to dark theme" aria-checked="false" class="theme theme-selected">
                                <i class="fa fa-moon-o"></i>
                            </button>
                        </div>
                    </div>
                </div>
            </div>



        </div>




        <script>
            window.playground_copyable = true;
        </script>


        <script src="../../../elasticlunr.min.js"></script>
        <script src="../../../mark.min.js"></script>
        <!--<script src="../../../searcher.js"></script>-->

        <script src="../../../clipboard.min.js"></script>
        <script src="../../../highlight.js"></script>
        <script src="../../../book.js"></script>

        <!-- Custom JS scripts -->
        <script src="../../../theme/pagetoc.js"></script>
        <script src="../../../theme/tabs.js"></script>
        <script src="../../../theme/ht_searcher.js"></script>
        <script src="../../../theme/sponsor.js"></script>

        <!-- Custom analytics -->
        <script defer src="https://www.fairanalytics.de/pixel/deXeO7BNBrMuhdG1"></script>



    </div>
    </body>
</html>
