---
name: rt-scenario-c005
description: "C-005: Container workload isolation and host-impact risk assessment. Domain: cloud. Authorized scenario for privileged containers, host mounts, Kubernetes RBAC, cloud identity, and remediation."
---

# C-005: Container Isolation and Host Impact Risk

## Overview

Container compromise becomes critical when workloads are privileged, have host mounts, share host namespaces, use powerful service accounts, or can reach cloud metadata. This scenario evaluates whether container-level access can become host, cluster, or cloud-level impact.

| Field | Value |
|---|---|
| Domain | Cloud / Containers |
| Objective | Assess container escape and blast radius risk |
| Required Access | Cluster read access or approved workload manifest review |
| Detection Risk | Low for review, High for active escape testing |
| Primary Impact | Host, cluster, or cloud account compromise |

## Prerequisites

- Cluster, namespace, and workload scope.
- Approved kubeconfig/cloud role.
- Test namespace for active validation if needed.
- No production escape attempts unless explicitly authorized and isolated.

## Risk Indicators

- `privileged: true`.
- Host filesystem mounts.
- Host PID/IPC/network namespaces.
- Added dangerous Linux capabilities.
- Writable Docker socket.
- Cluster-admin service account.
- Metadata service reachable with powerful cloud role.

## Workflow

1. Inventory workloads and namespaces.
2. Review pod specs for risky isolation settings.
3. Review RBAC and service account tokens.
4. Review network policies and metadata access.
5. Review image provenance and secrets exposure.
6. Model blast radius from a compromised pod.
7. Recommend controls by highest break-point value.

## MITRE ATT&CK Mapping

| Phase | Tactic | Technique |
|---|---|---|
| Escape | Privilege Escalation | Escape to Host |
| Lateral | Lateral Movement | Container and Resource Discovery |
| Cloud | Credential Access | Cloud Instance Metadata API |

## Evidence

- Sanitized pod spec.
- RBAC summary.
- Service account permissions.
- Network policy state.
- Cloud role policy summary.

## Remediation

- Enforce restricted Pod Security Standards.
- Remove host mounts and privileged mode.
- Reduce Linux capabilities.
- Scope service accounts per workload.
- Add network policies.
- Block metadata service where unnecessary.
- Enable runtime detection.

