Topic

Container Privileges

The question of which user account a containerised process runs as, and what an attacker inherits when that account is root.

Current clusters

build1 publisher

Conductor OSS runs a stranger's inline JavaScript as root in its default container

An unauthenticated POST to the Conductor Workflow API registers a definition whose inline expression evaluates in a GraalVM context with host access enabled, and the default image runs that process as root. Empirical Security logged attempts in August.

Publishers:dev.to

Reality

Evidence58
Adoption34
Hype gap+14
Incentives62
Confidence46