PE-CTR
ctr
Low-level CLI for containerd, used to inspect and manage containers directly when Docker is not present.
OVERVIEW
ctr (github.com/containerd/containerd, under cmd/ctr) is the barebones debug CLI shipped with containerd, the container runtime that sits underneath Docker and is also the default runtime on most Kubernetes nodes. It talks straight to the containerd socket (commonly `/run/containerd/containerd.sock`) without a Docker daemon in the middle, which matters because plenty of hardened or Kubernetes-only hosts have containerd but no `docker` binary at all.
The project itself warns that ctr is a debug tool, not a production interface, but that's exactly what makes it useful in a pentest: it can list and pull images, inspect existing tasks/containers, and — if the socket is reachable by a non-root user — spawn a new container with a privileged, host-mounted configuration to escalate off the node.
USE CASES
Practical use cases
- 01
Enumerating running containers and images on a node where Docker is not installed.
- 02
Checking permissions on the containerd socket as a potential root-escalation path.
- 03
Spawning a privileged, host-mounted container via ctr to confirm a breakout finding.
- 04
Cross-checking what a Kubernetes-managed pod is actually running at the containerd level.
QUICK START
On a host or Kubernetes node that runs containerd but has no Docker daemon, to enumerate and interact with containers at a lower level.
- Confirm containerd-level container breakout is explicitly in scope, since it affects the host or node, not one container.
- Check whether the containerd socket is reachable and by which local users/groups.
- Use `ctr images ls` and `ctr tasks ls` (per namespace, e.g. `-n k8s.io`) to enumerate what is running.
- If access allows, test spawning a container with elevated privileges to confirm the escalation path.
sudo ctr -n k8s.io tasks lsBEFORE YOU RUN IT
What to check before running it
containerd namespaces images/containers (`k8s.io` for Kubernetes-managed ones) — check the right namespace or results will look empty.
A reachable containerd socket is generally equivalent to host root, same as an exposed Docker socket — only test this against a host explicitly in scope.
It's a debug tool by the project's own description; commands like `ctr run` bypass higher-level orchestration (Docker, Kubernetes) entirely, so changes it makes are not visible to those layers.