Well most certainly container to host escalation is possible, but if you play your cards well enough it is highly unlikely. From the security section [1] : >

Well most certainly container to host escalation is possible, but if you play your cards well enough it is highly unlikely. From the security section [1] : > Your average server (bare metal or virtual machine) needs to run a bunch of processes as root. Those typically include SSH, cron, syslogd; hardware management tools (e.g., load modules), network configuration tools (e.g., to handle DHCP, WPA, or VPNs), and much more. A container is very different, because almost all of those tasks are handled by the infrastructure around the container ... > This means that in most cases, containers will not need "real" root privileges at all. And therefore, containers can run with a reduced capability set; meaning that "root" within a container has much less privileges than the real "root". For instance, it is possible to ... > This means that even if an intruder manages to escalate to root within a container, it will be much harder to do serious damage, or to escalate to the host ... [1] : https://docs.docker.com/articles/security/ https://docs.docker.com/articles/security/