HackBlue

Labs / Container audit

Not privileged, but close enough

None of the containers on mon-01 is privileged, but one combines extra capabilities, the host PID namespace, and no seccomp profile. Read docker inspect with jq and explain why that matters.

  • Terminal mission
  • Intermediate
  • 4 objectives
  • 0 of 4 solved

Briefing

A compliance check reported "no privileged containers" on mon-01 and passed. You have been asked to look again.

Privileged is one flag. CapAdd, PidMode, and SecurityOpt each give back part of what a container normally cannot do. SYS_PTRACE with the host PID namespace lets a container read and attach to processes on the host.

analyst@mon-01

mon-01 · Container audit

Type help for the command list and objectives for your tasks. Everything runs in this browser.

Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.