# How Chainguard protects against "Leaky Vessel" container escape vulnerabilities

DevFeed: [How Chainguard protects against "Leaky Vessel" container escape vulnerabilities](<https://devfeed.tech/articles/how-chainguard-protects-against-leaky-vessel-container-escape-vulnerabilities-13084.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/how-chainguard-protects-against-leaky-vessel-container-escape-vulnerabilities>)

Published: 2024-02-01T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [container-security](<https://devfeed.tech/topics/container-security.md>), [chainguard images](<https://devfeed.tech/topics/chainguard-images.md>), [container images](<https://devfeed.tech/topics/container-images.md>)

Tags: [apko](<https://devfeed.tech/tags/apko.md>), [chainguard](<https://devfeed.tech/tags/chainguard.md>), [container-escape](<https://devfeed.tech/tags/container-escape.md>), [container-images](<https://devfeed.tech/tags/container-images.md>), [container-security](<https://devfeed.tech/tags/container-security.md>), [docker](<https://devfeed.tech/tags/docker.md>), [docker-image](<https://devfeed.tech/tags/docker-image.md>), [leaky-vessel](<https://devfeed.tech/tags/leaky-vessel.md>), [patches](<https://devfeed.tech/tags/patches.md>), [runc](<https://devfeed.tech/tags/runc.md>), [secure-by-default](<https://devfeed.tech/tags/secure-by-default.md>), [upgrade](<https://devfeed.tech/tags/upgrade.md>)

## AI overview

This article explains the "Leaky Vessel" vulnerabilities affecting runc and BuildKit, including risks of container escape, host filesystem access, and elevated privileges. It describes how Chainguard Images use apko instead of runc or BuildKit and recommends upgrading to patched versions.

## Source excerpt

Chainguard's response to 'Leaky Vessel' vulnerabilities: safeguarding container images with innovative, secure-by-default build processes.