Catalog DÆMON

DMN · Tool

nerdctl

1 technique LinuxDÆMON GPL-3.0

Escape to Host

NEW
Privilege EscalationExecution Linux

nerdctl is the Docker-compatible CLI for containerd and accepts docker run flags. On a node with containerd, an operator can run a --privileged container that bind-mounts the host root (-v /:/host) and chroot /host to obtain node root, the same host-mount escape as docker/ctr but through the nerdctl front-end.

Use Escape to node root via containerd using familiar docker-style --privileged and host-mount flags.

nerdctl run --privileged --rm -it -v /:/host alpine chroot /host sh
Context
admin
Native
Escape to Host, Bind Mount Escape
MITRE
T1611
Detection
Detection: Auditd/EDR for nerdctl invocations with --privileged or -v /:/ (host-root bind) and for new containerd tasks not launched by kubelet. Restrict access to the containerd socket and to the nerdctl binary; alert on chroot into a host-root mount inside a container.
Verified
✓ nerdctl command-reference confirms Docker-compatible `--privileged` and `-v` bind mounts; same host-mount escape as docker but nerdctl is NOT a GTFOBins/LOLBAS binary, so the entry is additive; T1611.