A new container escape vulnerability just dropped. It gives an attacker the ability to hop from container to host OS via runc.

These demos show a container being able to read /etc/shadow via docker run or docker build commands. They're pulling specifically crafted images with the exploit preloaded

Snyk researchers, who found these vulns say this: "Snyk recommends you update any instances of runc to version 1.1.12 or later, as well as any software that depends on runc."

@mattjay i find your vague use of the word container to describe docker specifically to be disturbing