PE-NSE
nsenter
Part of util-linux; enters the namespaces of an existing process, the classic way to attach to or escape a container.
OVERVIEW
nsenter (part of util-linux, github.com/util-linux/util-linux) runs a command inside the namespaces of an already-running target process — mount, UTS, IPC, network, PID, user, cgroup — instead of creating new ones. Given a PID, `nsenter -t <pid> -a` drops you into that process's full namespace set, which is exactly what a container runtime does under the hood, and exactly why nsenter is the classic manual tool for both entering a running container from the host and, when misconfiguration allows it, escaping one.
The most common breakout scenario is a container run with `--pid=host` or with `SYS_ADMIN`/`SYS_PTRACE` capabilities and access to `/proc`: from inside, nsenter can target a host PID visible through the shared PID namespace and attach to its mount namespace to reach the real host filesystem, no exploit required beyond the misconfiguration itself.
USE CASES
Practical use cases
- 01
Attaching to a running container's namespaces from the host for live inspection without `docker exec`.
- 02
Escaping a container that shares the host PID namespace (`--pid=host`) by entering a host process's mount namespace.
- 03
Inspecting the network namespace of another container or process to see its actual routes/sockets.
- 04
Reproducing and demonstrating a namespace-isolation misconfiguration for a finding write-up.
QUICK START
On a host after gaining a foothold, to attach to a target process's namespaces — a container or another user's session — for inspection or breakout.
- Confirm the host is explicitly in scope before attempting any namespace-based breakout — this affects the underlying node, not one container.
- From inside a container or as a low-privileged user, check `/proc/[pid]/ns/` to see which namespaces are shared with the host.
- If a host PID is visible (shared PID namespace), use `nsenter -t <pid> -a` or target a specific namespace (`-m`, `-n`) to attach.
- Confirm what access the new shell actually has (host filesystem, host network) and document it before going further.
nsenter -t 1 -m -u -i -n -p -- bashBEFORE YOU RUN IT
What to check before running it
A successful nsenter-based breakout affects the underlying host, not just the current container — only exercise this against a host explicitly named in scope.
Requires `SYS_PTRACE` (or root) to target another process's namespaces; a container without it and without a shared PID namespace is not exploitable this way.
Attaching to another user's or service's namespace can expose live production state (open sockets, in-flight requests) — treat that data per the engagement's handling rules.