Hacker News Reader

This is just totally wrong. Any decent container configuration (including the default docker configuration) will agressively drop capabilities, preventing you from doing this, and any other script-kiddie attack.

See my other comment in this thread for a more accurate answer.

View on HN

Yes, you probably need a proper kernel vulnerability, which you can exploit in a reduced environment. Not trivial, but not impossible, scanning this years CVEs some would probably be sufficient (eg ones that only nees socket access).

Can't you take advantage of a kernel vulnerability on any reduced environment, regardless of LXC?

Not in certain container types such as a full VM.

Not wrong at all. He asked about LXC. Privilege restrictions are not part of LXC.

Reply on news.ycombinator.com