runc bug: a container can take over its host
A flaw in runc, used by Docker and Kubernetes, lets a malicious container gain root on the host. Update this week.
Last week a critical bug was disclosed in runc (CVE-2019-5736), the low-level tool that Docker, containerd, Kubernetes and others use to run containers. A malicious container, or a malicious image, can overwrite the runc binary on the host and get root access to the whole machine.
Containers are often treated as a security boundary. This is a reminder that they share the host’s kernel and tools.
What to do:
- Update Docker, containerd or runc through your distribution or vendor. Managed Kubernetes providers are rolling out fixes too.
- Run only images you trust, from your own registry or verified publishers.
- Don’t run containers as root inside the container. Use user namespaces where you can.
- Keep SELinux or AppArmor enabled. In some setups they block this attack.
Separate workloads that need real isolation onto separate hosts or VMs.