Score container escape risk from privileged containers, mounted runtime sockets, host namespaces, capabilities, runtime class and kernel patch age.
Escape risk has two independent halves: what the workload is allowed to ask for, and what the host would let it get away with. A mounted runtime socket scores highest because it needs no exploit at all — you simply ask the daemon to start a privileged container — while seccomp, SELinux and a current kernel are the controls that turn a published kernel CVE into a failed syscall. Container escape converts one compromised application into a compromised node, and from there into every secret and token that node has ever mounted, which is why the multi-tenancy assumption behind most clusters depends on this number staying low.
Container Escape Risk
Escape points = 12 × runtime-socket mounts + 10 × privileged + 8 × CAP_SYS_ADMIN + 6 × host-PID + 4 × writable hostPath containers, normalised per 1000 containers.
Host hardening
Host hardening penalty = runtime class + seccomp + SELinux/AppArmor points + min(15, 0.05 × kernel patch age in days). Total risk = workload penalty + host penalty, clamped to 0–100.
Escape points = 12 × runtime-socket mounts + 10 × privileged + 8 × CAP_SYS_ADMIN + 6 × host-PID + 4 × writable hostPath containers, normalised per 1000 containers. Escape risk has two independent halves: what the workload is allowed to ask for, and what the host would let it get away with. A mounted runtime socket scores highest because it needs no exploit at all — you simply ask the daemon to start a privileged container — while seccomp, SELinux and a current kernel are the controls that turn a published kernel CVE into a failed syscall.
Container escape converts one compromised application into a compromised node, and from there into every secret and token that node has ever mounted, which is why the multi-tenancy assumption behind most clusters depends on this number staying low.
This calculator takes 10 inputs: Containers running in the fleet, Containers running privileged, Containers mounting the container runtime socket, Containers holding CAP_SYS_ADMIN, Containers sharing the host PID namespace, Containers with a writable hostPath mount, Container runtime, Seccomp profile, SELinux or AppArmor, Age of the running kernel patch level. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
It is equivalent to giving the container root on the host. Anything that can talk to the runtime socket can create a new container with the host filesystem mounted and no restrictions, then chroot into it. There is no configuration that makes it safe — use a rootless builder such as Kaniko or Buildah, or a separate build service.
They substantially reduce it. gVisor intercepts syscalls in userspace and Kata gives each pod its own kernel in a lightweight VM, so a kernel bug in the guest does not reach the host. The cost is syscall latency and some incompatibility, which is why they are usually reserved for untrusted or multi-tenant workloads.