All notable changes to this project will be documented in this file.
The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.
- Initial lab structure with 5 security labs
- Lab 01: Prompt injection simulation (deterministic, no LLM required)
- Lab 02: Docker socket escape — sibling container reads host files, writes to host
/tmp - Lab 03: Privileged container escape — mount host block devices from
--privilegedcontainer - Lab 04: Cgroup v1 release_agent escape — arbitrary code execution on host (graceful fallback on cgroups v2)
- Lab 05: Docker vs void-box comparison — runs same checks in both environments side by side
AGENTS.mdwith project conventions for AI coding agentsCLAUDE.mdwith Claude Code specific guidance