Gitea act_runner container escape via privileged Docker options (--pid=host, --cap-add=ALL, nsenter)
This rule detects the execution of container runners (act-runner/gitea-act-runner) with insecure container isolation flags, such as mounting the host root filesystem, disabling security profiles (seccomp/apparmor), or running with host namespaces and excessive capabilities. These configurations indicate potential container escape attempts or misconfigurations that allow significant host-level access.
Splunk (SPL)
