# container escape

Published articles for container escape.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Exploring the Chainguarden at Black Hat USA 2025

DevFeed: [Exploring the Chainguarden at Black Hat USA 2025](<https://devfeed.tech/articles/exploring-the-chainguarden-at-black-hat-usa-2025-13039.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/exploring-the-chainguarden-at-black-hat-usa-2025>)

Published: 2025-08-15T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard](<https://devfeed.tech/topics/chainguard.md>), [Security](<https://devfeed.tech/topics/security.md>), [Containers](<https://devfeed.tech/topics/containers.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>)

Tags: [2025](<https://devfeed.tech/tags/2025.md>), [attacks](<https://devfeed.tech/tags/attacks.md>), [black-hat](<https://devfeed.tech/tags/black-hat.md>), [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-containers](<https://devfeed.tech/tags/chainguard-containers.md>), [container](<https://devfeed.tech/tags/container.md>), [container-escape](<https://devfeed.tech/tags/container-escape.md>), [containers](<https://devfeed.tech/tags/containers.md>), [defcon](<https://devfeed.tech/tags/defcon.md>), [events](<https://devfeed.tech/tags/events.md>), [orca-security](<https://devfeed.tech/tags/orca-security.md>), [security](<https://devfeed.tech/tags/security.md>), [security-events](<https://devfeed.tech/tags/security-events.md>), [talks](<https://devfeed.tech/tags/talks.md>), [trust](<https://devfeed.tech/tags/trust.md>), [vanta](<https://devfeed.tech/tags/vanta.md>)

### AI overview

Chainguard recaps its activities at Black Hat USA 2025, including the garden-themed Chainguarden booth, partnerships with Vanta and Orca Security, and follow-up participation at DEF CON 33. The article also highlights a Container Escapes 101 workshop covering container escape attacks, exploitation potential, and vulnerabilities in container use.

### Source excerpt

See what Chainguard was up to at Black Hat USA 2025, from a garden-themed booth to several engaging activations with organizations like Vanta and Orca Security.

## How Chainguard protects against "Leaky Vessel" container escape vulnerabilities

DevFeed: [How Chainguard protects against "Leaky Vessel" container escape vulnerabilities](<https://devfeed.tech/articles/how-chainguard-protects-against-leaky-vessel-container-escape-vulnerabilities-13084.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/how-chainguard-protects-against-leaky-vessel-container-escape-vulnerabilities>)

Published: 2024-02-01T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [container-security](<https://devfeed.tech/topics/container-security.md>), [chainguard images](<https://devfeed.tech/topics/chainguard-images.md>), [container images](<https://devfeed.tech/topics/container-images.md>)

Tags: [apko](<https://devfeed.tech/tags/apko.md>), [chainguard](<https://devfeed.tech/tags/chainguard.md>), [container-escape](<https://devfeed.tech/tags/container-escape.md>), [container-images](<https://devfeed.tech/tags/container-images.md>), [container-security](<https://devfeed.tech/tags/container-security.md>), [docker](<https://devfeed.tech/tags/docker.md>), [docker-image](<https://devfeed.tech/tags/docker-image.md>), [leaky-vessel](<https://devfeed.tech/tags/leaky-vessel.md>), [patches](<https://devfeed.tech/tags/patches.md>), [runc](<https://devfeed.tech/tags/runc.md>), [secure-by-default](<https://devfeed.tech/tags/secure-by-default.md>), [upgrade](<https://devfeed.tech/tags/upgrade.md>)

### AI overview

This article explains the "Leaky Vessel" vulnerabilities affecting runc and BuildKit, including risks of container escape, host filesystem access, and elevated privileges. It describes how Chainguard Images use apko instead of runc or BuildKit and recommends upgrading to patched versions.

### Source excerpt

Chainguard's response to 'Leaky Vessel' vulnerabilities: safeguarding container images with innovative, secure-by-default build processes.

## Server-side sandboxing: Containers and seccomp

DevFeed: [Server-side sandboxing: Containers and seccomp](<https://devfeed.tech/articles/server-side-sandboxing-containers-and-seccomp-10038.md>)

Original publisher: [Read original article](<https://www.figma.com/blog/server-side-sandboxing-containers-and-seccomp/>)

Author: Hongyi Hu; Max Serrano

Published: 2023-10-24T00:00:00Z

Content type: article

Language: en

Sources: [Figma Blog](<https://devfeed.tech/sources/figma-blog.md>)

Topics: [Containers](<https://devfeed.tech/topics/containers.md>), [Security](<https://devfeed.tech/topics/security.md>), [Figma](<https://devfeed.tech/topics/figma.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Docker](<https://devfeed.tech/topics/docker.md>), [Linux](<https://devfeed.tech/topics/linux.md>), [SELinux](<https://devfeed.tech/topics/selinux.md>)

Tags: [code](<https://devfeed.tech/tags/code.md>), [container-escape](<https://devfeed.tech/tags/container-escape.md>), [containers](<https://devfeed.tech/tags/containers.md>), [docker](<https://devfeed.tech/tags/docker.md>), [figma](<https://devfeed.tech/tags/figma.md>), [linux](<https://devfeed.tech/tags/linux.md>), [security](<https://devfeed.tech/tags/security.md>), [security-vulnerabilities](<https://devfeed.tech/tags/security-vulnerabilities.md>), [selinux](<https://devfeed.tech/tags/selinux.md>), [systems](<https://devfeed.tech/tags/systems.md>)

### AI overview

This article explains how Figma uses containers and seccomp for server-side sandboxing and security isolation. It compares container isolation with virtual machines, examines container escape risks, and describes how runtime behavior, operating-system primitives, and configuration affect security.

### Source excerpt

Containers and secure computing mode (seccomp) are sandboxing primitives that offer a lighter weight alternative to virtual machines (VMs). Here we cover the differences between them, and how we use both at Figma to achieve security isolation.

## Stop Container Escape and Prevent Privilege Escalation

DevFeed: [Stop Container Escape and Prevent Privilege Escalation](<https://devfeed.tech/articles/stop-container-escape-and-prevent-privilege-escalation-29884.md>)

Original publisher: [Read original article](<https://goteleport.com/blog/stop-container-escape-privilege-escalation/>)

Author: info@goteleport.com (Sadequl Hussain)

Published: 2022-03-18T00:00:00Z

Content type: tutorial

Language: en

Sources: [Teleport](<https://devfeed.tech/sources/teleport.md>)

Topics: [container](<https://devfeed.tech/topics/container.md>), [Security](<https://devfeed.tech/topics/security.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Docker](<https://devfeed.tech/topics/docker.md>), [ImageMagick](<https://devfeed.tech/topics/imagemagick.md>), [Azure](<https://devfeed.tech/topics/azure.md>)

Tags: [azure](<https://devfeed.tech/tags/azure.md>), [container](<https://devfeed.tech/tags/container.md>), [container-escape](<https://devfeed.tech/tags/container-escape.md>), [docker-container](<https://devfeed.tech/tags/docker-container.md>), [exploit](<https://devfeed.tech/tags/exploit.md>), [imagemagick](<https://devfeed.tech/tags/imagemagick.md>), [security](<https://devfeed.tech/tags/security.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

### AI overview

This tutorial explains how container escapes can breach isolation boundaries and enable privilege escalation to the host system. It describes attack paths involving privileged software, host filesystem mounts, kernel bugs, weak configuration, and access controls, and outlines the potential impact on containers, files, databases, and other host resources.

### Source excerpt

Container escape is a security risk in which malicious players can leverage containerized apps. Deep-dive into the risks and how to prevent privilege escalation.