Docker security

Seccomp is a mechanism to restrict the actions available within the container by restricting system calls that a process could make. It can block process from sending system calls to CPU. When you run a container, it uses the default seccomp profile unless you override it with the --security-opt option. You can run a container without the default seccomp profile by setting seccomp to unconfined ( --security-opt "seccomp=unconfined" ).

If a sysadmin doesn't permit users to mount volumes and run containers with the --privileged flag or give any extra capability to the container, an attacker can try run a container unsetting seccomp feature, then create a shell inside the running container and finally give it the extra privileges. Here an example with the following video :