Docker cp Copyout Path Traversal Container Escape (docker-cp-copyout-destination-escape)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects activity indicative of container escape attempts, specifically identifying the use of 'docker cp' with path traversal sequences to manipulate host files, or the unauthorized execution of shells and utilities directly spawned by the container runtime daemon (dockerd). It also monitors for execution patterns associated with known container escape proof-of-concept scripts.