{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T08:48:01Z","timestamp":1782809281482,"version":"3.54.5"},"reference-count":0,"publisher":"ECMS","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,6,23]]},"abstract":"<jats:p>Containerized environments rely on shared-kernel isolation, making container breakouts and privilege escalation critical security risks. This paper presents an empirical evaluation of eBPF-based runtime security using the Tetragon platform against real-world runc vulnerabilities. Two representative exploits are analyzed: a file-descriptor leak enabling host filesystem access (CVE-2024-21626) and a masked-path time-of-check time-of-use (TOCTOU) race leading to host-level code execution with root privileges (CVE-2025-31133). For each case, concise Tetragon policies intercept decisive kernel interactions and prevent isolation violations synchronously in-kernel. To our knowledge, this is the first empirical validation of eBPF-based security tools against publicly disclosed, actively exploited container runtime CVEs, demonstrating effectiveness without application-specific policies. Performance measurements under a realistic HTTP workload show minimal overhead, with under 1% throughput degradation and approximately 2% latency increase. These results indicate that eBPF-based enforcement provides effective, low-overhead protection against container runtime vulnerabilities in dynamic environments.<\/jats:p>","DOI":"10.7148\/2026-0321","type":"proceedings-article","created":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T08:36:46Z","timestamp":1782808606000},"page":"321-330","source":"Crossref","is-referenced-by-count":0,"title":["Using ebpf-based tools for detection and mitigation of container breakouts and privilege escalation"],"prefix":"10.7148","author":[{"given":"Anna","family":"Plichta","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Serhii","family":"Cherepiuk","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"4144","published-online":{"date-parts":[[2026,6,23]]},"event":{"name":"40th ECMS International Conference on Modelling and Simulation"},"container-title":["ECMS 2026 Proceedings edited by Filippo Sanfilippo, Florenc Demrozi, Fabio Sgarbossa, Mohammad Poursina"],"original-title":[],"deposited":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T08:36:56Z","timestamp":1782808616000},"score":1,"resource":{"primary":{"URL":"http:\/\/www.scs-europe.net\/dlib\/2026\/ecms2026acceptedpapers\/0321_secmos_ecms2026_0028.pdf"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,6,23]]},"references-count":0,"URL":"https:\/\/doi.org\/10.7148\/2026-0321","relation":{},"subject":[],"published":{"date-parts":[[2026,6,23]]}}}