Containers: Security Story
Container
Malicious or Buggy Process
Pid Namespace
Root Namespace
Userspace
Trusted Process
Attack Surface
Kernel
Container processes can attack the kernel
After all Containers run as native processes on top of the kernel.
Any malicious or buggy process can attack the kernel and gain root.
Once it becomes root it can do anything it wants.