Hacker News Reader

Yes, it is trivial for a root user in an LXC container to break out. One can load a kernel module from within a container, for example. LXC containers do not provide security partitioning at all.

View on HN

This is just totally wrong. Any decent container configuration (including the default docker configuration) will agressively drop capabilities, preventing you from doing this, and any other script-kiddie attack.

See my other comment in this thread for a more accurate answer.

Not wrong at all. He asked about LXC. Privilege restrictions are not part of LXC.

Yes, you probably need a proper kernel vulnerability, which you can exploit in a reduced environment. Not trivial, but not impossible, scanning this years CVEs some would probably be sufficient (eg ones that only nees socket access).

Can't you take advantage of a kernel vulnerability on any reduced environment, regardless of LXC?

Not in certain container types such as a full VM.

Reply on news.ycombinator.com