Whilst from an overall security perspective, this may not be that meaningful (the pre-req's are CAP_SYS_ADMIN or --privileged), it's still a really neat hack.
Also a good demonstration of how runc container security is really just Linux security, and the isolation provided by that type of container, is dependent on underlying Linux features.
I could see circumstances where this would be of practical use, where you've landed in a privileged container and are looking for a relatively easy/universal breakout to the underlying node.
The ToB breakdown is cool too as the initial tweet was a bit hard to parse, unless your Bashfu is good.
(ofc the post from ToB I'm really looking forward to hasn't been released yet, which is what they found in the Kubernetes audit)
Also a good demonstration of how runc container security is really just Linux security, and the isolation provided by that type of container, is dependent on underlying Linux features.
I could see circumstances where this would be of practical use, where you've landed in a privileged container and are looking for a relatively easy/universal breakout to the underlying node.
The ToB breakdown is cool too as the initial tweet was a bit hard to parse, unless your Bashfu is good.
(ofc the post from ToB I'm really looking forward to hasn't been released yet, which is what they found in the Kubernetes audit)