Use when writing Dockerfiles, docker-compose files, Podman configurations, or reviewing container security. Covers runtime escapes, supply chain attacks, GPU passthrough vulnerabilities, registry hardening, and 2024-2025 CVEs for Docker, Podman, BuildKit, Harbor, and NVIDIA Container Toolkit.
Reference guide for container security anti-patterns covering Docker, Podman, Docker Compose, Podman Compose, scratch-based containers, GPU passthrough, and private registries. Includes 2024-2025 CVEs and real-world escape techniques.
| Category | Reference File | Key CVEs |
|---|---|---|
| Dockerfile builds | references/dockerfile.md | CVE-2024-24557, CVE-2024-23651, CVE-2025-0495 |
| Runtime security | references/runtime-security.md | CVE-2025-31133, CVE-2024-21626, CVE-2021-41091 |
| Compose files | references/compose-security.md | - |
| Supply chain | references/supply-chain.md | CVE-2024-3094 |
| Podman-specific | references/podman-security.md | - |
| GPU passthrough | references/gpu-passthrough.md | CVE-2024-0132, CVE-2025-23266, CVE-2025-23359 |
| Registry security | references/registry-security.md | CVE-2024-22278, CVE-2024-22261, CVE-2022-46463 |
| Scanning & SBOM | references/scanning-sbom.md | - |
| Vector | CVE | Mitigation |
|---|---|---|
| runc masked path | CVE-2025-31133 | Update runc to 1.2.6+ |
| runc procfs race | CVE-2025-52565 | Update runc to 1.2.6+ |
| File descriptor leak | CVE-2024-21626 | Update runc to 1.1.12+ |
| NVIDIA TOCTOU | CVE-2024-0132 | Update toolkit to 1.16.2+ |
| Docker socket mount | N/A | Never mount /var/run/docker.sock |
| Privileged mode | N/A | Never use --privileged |
| cgroups release_agent | N/A | Block CAP_SYS_ADMIN |
# Check container is not running as root
docker exec CONTAINER id
# Check capabilities
docker exec CONTAINER capsh --print
# Check seccomp profile
docker inspect --format='{{.HostConfig.SecurityOpt}}' CONTAINER
# Check for socket mounts
docker inspect --format='{{.Mounts}}' CONTAINER | grep docker.sock
# Scan image for vulnerabilities
trivy image IMAGE:TAG
# Generate SBOM
trivy image --format cyclonedx IMAGE:TAG