runc

runc is the OCI runtime under Docker/containerd/CRI-O. Where runc is available with root, an operator can generate an OCI bundle with runc spec, edit config.json to bind-mount the host root (source "/") into the container, and runc run it, producing a container whose filesystem is the node's, granting full host access outside any orchestration policy.

Use Spawn an OCI container that bind-mounts the host root to reach node root when runc is runnable as root.

runc spec
# edit config.json mounts: {"type":"bind","source":"/","destination":"/","options":["rbind","rw","rprivate"]}
mkdir rootfs
runc run esc

Context

admin

Native

Escape to Host, Bind Mount Escape

MITRE

T1611

Detection

Detection: Auditd/EDR for runc spec and runc run invocations that are not children of containerd-shim/dockerd (i.e. manual bundles), and for config.json files whose mounts bind source "/". Flag new OCI bundle directories written to disk followed by runc run.

Verified

✓ HackTricks runc page confirms `runc spec` -> edit config.json to bind-mount source '/' -> `runc run`; also confirms runc must run as root (privilege=admin). T1611; runc is not a GTFOBins binary.

Refs

book.hacktricks.xyz/linux-hardening/privilege-escalation/runc-privilege-escalation

attack.mitre.org/techniques/T1611/