runtime security

Most escapes are not clever kernel exploits. They are configuration that handed the container the host: a privileged flag, a mounted socket, a host path or a shared namespace.

Snapshot a disk, read it somewhere else, delete the snapshot. That trick built a product category. Interviewers ask how it works, what permissions it needs, and what it cannot see.

Four open-source tools, four different questions: what happened, what is the state now, is this behaviour forbidden, and can the kernel stop it. Choosing well starts with knowing which question each answers.