Gitea Act Runner container option injection with host namespace flags

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

Detects Gitea Act Runner spawning Docker containers with high-risk security options (e.g., --privileged, --pid=host, --ipc=host, --cap-add=ALL, or security profile unconfined). These flags are often used to attempt a container escape, allowing a process running within a Gitea CI/CD workflow to gain unauthorized access to the underlying host or other container resources.