Container Breakout - CI/CD用語集の定義
container breakout は、プロセスがcontainerのnamespaceやcgroupから抜け出して、ホストや隣接するcontainerにアクセスしてしまうことで、多くの場合カーネルのバグや過剰な権限を持つ設定が原因です。使い捨てのrunner、rootlessモード、seccompが影響範囲を縮小します。
関連ガイド
Sandbox Escape - CI/CD Glossary DefinitionA sandbox escape is code breaking out of its confined environment to affect the host, defeating the isolation…
Privilege Escalation - CI/CD Glossary DefinitionPrivilege escalation is gaining higher permissions than granted - user to root, or one role to a broader one…
Image Vulnerability - CI/CD Glossary DefinitionAn image vulnerability is a known security flaw in a container image’s OS packages or libraries, surfaced by…