SG-033: Container Escape Surface

Severity: CRITICAL

Privileged container, docker.sock mount, sensitive hostPath

Fires when

• A container is marked privileged (privileged: true or --privileged)
• The host docker.sock or a container-runtime socket (crio / containerd) is mounted
• A high-privilege Linux capability (SYS_ADMIN, ALL, NET_ADMIN) is added
• A k8s hostPath mounts a sensitive host path (/proc, /sys, /root, /dev, /etc)

Remediation

No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.