Container escape

Getting from inside a container to the host, usually via a kernel vulnerability, an over-permissive capability, a mounted host path or a mounted container socket. It is the reason containers are called an isolation mechanism rather than a security boundary: everything shares one kernel. The practical defences are unglamorous — run as non-root, drop capabilities, never mount the runtime socket, and keep nodes patched.