Container runtime and CI exposure

cloud_container_exposure

Checks for a reachable Docker or containerd socket (which is root on the host), a mounted Kubernetes service-account token, container membership, and credential-bearing CI environment variables. Read-only: no container is created and no token value is read.

Severity high how bad it would be if it were real

Expected outcome Something should notice

Platforms 3 macOS, Linux, Windows

Isolation subprocess runs in its own process, so a kill is a measurement

What it needs before it will run

runs in --safe
Observation only. It runs even in the inert mode, because it changes nothing and sends nothing.

Gates are cumulative and none of them is implied by another: see the three gates for why they are separate decisions.

ATT&CK techniques it exercises

MITRE ATT&CK techniques this test maps to.
Technique	Name	Tactic	Across public reports
T1552.001	Credentials In Files	Credential Access	coverage statistics
T1610	Deploy Container	Execution	coverage statistics
T1613	Container and Resource Discovery	Discovery	coverage statistics

How often anything notices

Not enough data: fewer than 3 public reports have run this test, so no rate is published for it. Groups below that threshold are withheld everywhere on the site — with one or two contributors an average is one organisation's result with a percent sign after it.

Other cloud and identity tests

Other tests in the Cloud and identity category.
Test	What it does	Severity
Cloud instance metadata access cloud_metadata_probe	Requests instance credentials from the link-local metadata service at 169.254.169.254 for AWS, Azure and GCP, including the token-free IMDSv1 path tha…	high

the whole catalogue this test in the list run it yourself

Catalogue generated from client 0.1.0. A test's behaviour can change between releases; this page describes the version named here.