[BobbyTables2]

I doubt your “distroless” container is any safer for this vulnerability .

Infecting sudo just makes for a quick demo.

If your container has different processes at different user ids, the exploit would still be effective.

It would likely also be able to “modify” read only files mapped from the host.

[himata4113]

distroless rootless containers don't have the syscalls enabled to do anything reasonable with this exploit