- [Instructor] What this also means
is that you can look at a container process
like you could any other process on a Linux host.
For this demo, we've already escaped to the ZCX host,
so we're looking from there.
Let's run a container with the name
honk command sleep 1312.
The honk isn't really necessary here.
I just wanted to honk at you.
If we list our containers,
we can then see that container running.
We can see this or any other container on the outside
by running a ps command,
which will show us containers running on the host
alongside other processes.
This command output will give you the process ID,
the user running it, the pid namespace number,
and the command-line argument.
If we want to take a look at the inside of the container,
we can do so by looking at the proc/ns folder
for the process ID of that container.
We found the pit of the container we just created
in the ps command output we just ran.
Let's take a closer look.
We take a look here, we can see the cgroup at the top
and the other namespaces on the bottom.
All processes in Linux are made up of these namespaces.
As of kernel version 5.6,
there's also a time namespace,
but ZCX runs an old-ass kernel,
so this demo won't show you that one.
Depending on the configuration
and how the container was created,
some of these namespaces might be shared with the host
and some might be unique to the container.
We're not going to get into that here,
but I recommend checking out the resources
in the reference section to learn more.
That's it.
Honestly, that might be the closest thing
you're ever going to be able to get to being able
to actually look at a container,
because that's all a container is;
a process made up of cgroups and namespaces.
Because containers do share resources with one another
and their hosts, containers present a wide
and varied attack (indistinct),
where if a container is compromised or mis-configured,
containers can compromise each other and their hosts.
I just think they're neat. They're fun to break.
So let's talk about breaking some.