Gitea Act Runner Container Options Injection — Host Namespace Escape

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•2

Detects potentially malicious container escape or privilege escalation attempts initiated by Gitea act runner processes. This includes the spawning of 'nsenter', the use of dangerous Docker flags that provide host-level access (such as host PID/IPC namespaces, all capabilities, or disabled security mechanisms), and the spawning of shells inside containers configured with namespace-entering commands.