> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/privesc/docker-escape.md).

# Docker 逃逸

Docker 逃逸路径会利用容器配置错误、挂载的主机资源、默认凭据、重复使用的密码或过高的容器权限。目标是从容器环境转移到主机级访问。

## 方法

* 确认 shell 是否位于容器内，并检查挂载、能力和暴露的套接字。
* 检查已挂载的主机路径、SSH 密钥、重复使用的凭据以及可写的 SUID 二进制文件。
* 使用最少侵入的逃逸路径来证明已获得主机访问。

## 快速检查

```bash
id
cat /proc/1/cgroup
挂载
ls -la /var/run/docker.sock 2>/dev/null
```

<table data-view="cards" data-full-width="false" data-search="false"><thead><tr><th></th><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><h3><i class="fa-docker" style="color:$primary;">:docker:</i></h3></td><td><h4>Docker 密码重复使用</h4></td><td>Docker 逃逸（密码重复使用）笔记，适用于 Linux 权限提升，包含枚举步骤、利用示例和面向报告的验证。</td><td><a href="/pages/beb7d9a177aa48fc7f9484bb9ff59339ff2f3439">/pages/beb7d9a177aa48fc7f9484bb9ff59339ff2f3439</a></td></tr><tr><td><h3><i class="fa-docker" style="color:$primary;">:docker:</i></h3></td><td><h4>Docker SUID 权限操作</h4></td><td>Docker 逃逸（SUID 权限操作）笔记，适用于 Linux 权限提升，包含枚举步骤、利用示例和面向报告的验证。</td><td><a href="/pages/d5bd3391ed8f7eee3990dfa511bbdc8bf396f692">/pages/d5bd3391ed8f7eee3990dfa511bbdc8bf396f692</a></td></tr><tr><td><h3><i class="fa-docker" style="color:$primary;">:docker:</i></h3></td><td><h4>使用 SSH 密钥进行 Docker 逃逸</h4></td><td>Docker 逃逸（SSH 密钥）笔记，适用于 Linux 权限提升，包含枚举步骤、利用示例和面向报告的验证。</td><td><a href="/pages/44b1b97ae7c29dd223b9bf08e29e97d6c23315cd">/pages/44b1b97ae7c29dd223b9bf08e29e97d6c23315cd</a></td></tr><tr><td><h3><i class="fa-docker" style="color:$primary;">:docker:</i></h3></td><td><h4>Docker Toolbox 默认凭据</h4></td><td>Docker 逃逸（Docker Toolbox 默认凭据）笔记，适用于 Linux 权限提升，包含枚举步骤、利用示例和面向报告的验证。</td><td><a href="/pages/5b843bfcb7739b889ba161dae4e6521fafa91979">/pages/5b843bfcb7739b889ba161dae4e6521fafa91979</a></td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/privesc/docker-escape.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.