Also the plot of Hollow Knight.
You would think you’d already have problems if someone’s managed to compromise one or more of your containers without you knowing though whether they can get the host or not
Could be serving users malware or silently sucking up all the sensitive data the container sees
What if anything do people do about anti virus in containers?
Dang that’s scary. The user would need ssh access to the container for this to work, right?
Even worse than that, they need to be able to make an arbitrary container from an arbitrary attacker-provided Dockerfile, or make fairly arbitrary calls to the Docker daemon (in which case you’ve already lost).
They’re rather uninteresting for anyone self-hosting containers as the runc vuln doesn’t offer a way to escape from within an already running container, while the BuildKit vulns all have fairly odd preconditions or require passing untrusted input. Quite the annoyance if you’re running some kind of public cloud or public CI/CD service, though.
