> ## Content Index
> Fetch the complete content index at: https://www.ostering.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Container Runtime (RT)

- URL: /taxonomies/software-factory/container-runtime/
- Published: 2026-10-31T13:00:00.000Z
- Updated: 2026-10-29T12:57:13.812Z
- Description: Container Runtime (RT): 13 threats in the software factory threat taxonomy, with mitigations. Runtimes, isolation boundaries, the host kernel, sandboxes.
- Author: Brett Crawley

[Taxonomies](/taxonomies/) › [Software factory](/taxonomies/software-factory/) › Container Runtime

**Station 15 of 17 · Line 2, Artifact to Runtime · 13 threats · prefix RT**

A container is a set of kernel features, not a security boundary unless it is configured as one. These cards cover container runtimes, isolation, the host kernel and sandboxes.

**Scope:** Runtimes, isolation boundaries, the host kernel, sandboxes.

![Table: Container Runtime (RT), 13 threats with their mitigation principles and design measures. The full text is in the PDF and Excel downloads on the software factory taxonomy overview page.](https://www.ostering.com/media/posts/118/taxonomy-table-15-RT.png =1400x4507)

*Text version: every entry on this page is in the [PDF and Excel downloads](/taxonomies/software-factory/) on the overview page, where it can be searched and copied.*

## The threats

- <span id="rt-a"></span>**RT·A** Container Escape
- <span id="rt-k"></span>**RT·K** Privileged Container
- <span id="rt-q"></span>**RT·Q** Host Mounts and Namespaces
- <span id="rt-j"></span>**RT·J** Shared Kernel Across Trust Levels
- <span id="rt-10"></span>**RT·10** Unconfined Syscalls
- <span id="rt-9"></span>**RT·9** Credential Reach from Containers
- <span id="rt-8"></span>**RT·8** Exposed Runtime API
- <span id="rt-7"></span>**RT·7** Undetected Runtime Drift
- <span id="rt-6"></span>**RT·6** Writable Root Filesystem
- <span id="rt-5"></span>**RT·5** No User Namespace
- <span id="rt-4"></span>**RT·4** Resource Exhaustion
- <span id="rt-3"></span>**RT·3** Unpacking Flaws
- <span id="rt-2"></span>**RT·2** Ephemeral Evidence

## Where this station touches others

- **Container Images and Container Runtime:** the image is what is packaged; the runtime is how it is contained.

## Seen in the wild

- **RT·A Container Escape:** runc CVE-2019-5736 (2019); runc CVE-2024-21626 (2024).
- **RT·8 Exposed Runtime API:** Graboid worm (Unit 42, 2019).

Sources for each case are listed on the [overview page](/taxonomies/software-factory/).

## STRIDE, CAPEC and CWE

Of the 13 entries here, STRIDE fits 12 cleanly and 1 only loosely. CAPEC 3.9 has a pattern that describes 3 of them directly, and only a generic parent pattern for 10. CWE 4.20 names the weakness directly for 7, has only a broader weakness for 6,. The table below gives the mapping entry by entry, with the names of the CAPEC patterns and CWE weaknesses; what the mapping shows across the whole taxonomy is in [Mapping the Software Factory Threat Taxonomy to STRIDE, CAPEC and CWE](/mapping-the-software-factory-threat-taxonomy/). The Excel, SKOS and STIX downloads carry the same mapping as text.

![Table: STRIDE, CAPEC and CWE mapping for Container Runtime (RT), 13 threats, with each entry's STRIDE categories and fit, CAPEC 3.9 patterns and CWE 4.20 weaknesses. The full mapping is in the Excel, SKOS and STIX downloads on the software factory taxonomy overview page.](https://www.ostering.com/media/posts/118/software-factory-mapping-table-15-RT.png =1400x1998)

---

← [Container Images (IM)](/taxonomies/software-factory/container-images/) · [Software factory overview](/taxonomies/software-factory/) · [Orchestration (OR)](/taxonomies/software-factory/orchestration/) →

*© 2026 Jonathan Brett Crawley. Licensed under [CC BY-NC-ND 4.0](https://creativecommons.org/licenses/by-nc-nd/4.0/) with additional permissions: see the licence on the [software factory overview](/taxonomies/software-factory/).*