Gitea act_runner container options injection — host namespace escape

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects a suspicious sequence of events where a Gitea act_runner process spawns a container with dangerous namespace or capability flags (e.g., --pid=host, --cap-add=ALL) followed by the execution of 'nsenter' in the same environment, indicating an attempt to escape the container to the host.