detecting-container-escape-attempts

Detects container escape at runtime across tooling - namespace manipulation, capability abuse, kernel exploits, sensitive host mounts, and anomalous syscalls - and explains which signals matter regardless of whether Falco, Sysdig, auditd, or an EDR is doing the collection. Use when deciding what breakout behaviour to monitor, investigating a suspected Docker or Kubernetes breakout, or comparing escape coverage across runtime sensors. Keywords: container escape, breakout, namespaces, CAP_SYS_ADMI

Install

KitScout test notes

Not tested by KitScout yet. When our harness runs it, pros, cons and the tasks we tried appear here, with the date and evidence.

Similar tools

• observability-and-instrumentation 117,221 ★
  Instruments code so production behavior is visible and diagnosable. Use when adding logging, metrics, tracing,
• honeycomb-tracing 113,505 ★
  Trace Paperclip runs, requests, and full CI suites in Honeycomb. Use to find traces, diagnose latency, design
• Netdata 81,392 ★
  Real-time infrastructure monitoring with metrics, logs, alerts, and ML-based anomaly detection.
• azure-monitor-opentelemetry-ts 49,672 ★
  Auto-instrument Node.js applications with distributed tracing, metrics, and logs.
• devops-troubleshooter 49,672 ★
  Expert DevOps troubleshooter specializing in rapid incident response, advanced debugging, and modern observabi