Which container can take over the host
Three containers run on a build server. Use docker inspect and jq to find the one that is privileged and holds the Docker socket, which together equal root on the host.
Briefing
A pentest report says "a CI job could escape to the host". You have read-only access to the Docker CLI on build-01.
A container started with --privileged sees host devices and has every capability. A container that mounts /var/run/docker.sock can ask the Docker daemon to start new containers with any setting, including the host filesystem. Either one is enough to become root on the host.
build-01 · Container audit
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.