Gitea act-runner container escape via --pid=host or --cap-add=ALL options

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects potential container breakout or privilege escalation attempts originating from Gitea act-runner processes. The rule monitors for the execution of containers with dangerous security configurations (e.g., host PID/IPC namespace, privileged capabilities, disabled security modules) or the use of nsenter to break out of a container into the host environment.