Blocking Container Escapes: VS Code Copilot and Docker --privileged

Correction note (2026-10-13). The per-call timings and latency figures that appeared in this article had no benchmark behind them and were removed. Sample output in this article is illustrative, not a recorded run. The only published measurement is p50 0.39 ms and p99 1.91 ms (sigmashake-bench daemon-socket run, 2026-06-10, ssg 0.29.156, n=500). Sub-2 ms evaluation is a design target.

Describe the task

VS Code Copilot encounters a permission error running a development container. To work around it, the agent appends --privileged:

docker run --privileged -v /:/host alpine sh

SSG blocks it immediately — privileged containers have full access to all host Linux capabilities and devices.

# illustrative sample output
[BLOCK] bash › docker run --privileged -v /:/host alpine — rule: no-docker-privileged

Give SSG context

SSG evaluates VS Code Copilot's shell commands via the SSG MCP Server integration.

Required context

rule no-docker-privileged {
  enabled true
  priority 100
  severity error
  DENY execution
  IF command STARTS_WITH "docker run "
  AND command CONTAINS "--privileged"
  MESSAGE "Privileged containers can escape to the host. Use specific capabilities instead."
}

Optional context

Also block dangerous root volume mounts:

rule no-docker-root-mount {
  enabled true
  priority 100
  severity error
  DENY execution
  IF command STARTS_WITH "docker run "
  AND command CONTAINS "-v /:"
  MESSAGE "Mounting the root filesystem is blocked. Use a scoped volume path."
}

What SSG does

SSG checks for --privileged in the raw docker run command before any container is created. The block fires at the tool-call layer — no container process is started.

Ask the agent to use specific capabilities instead

--privileged was blocked. Add only the specific Linux capability you need:
  docker run --cap-add=NET_ADMIN ...   # for network operations
  docker run --cap-add=SYS_PTRACE ... # for debugging
Don't mount the root filesystem — use a named volume or a specific directory.

How your rule handles flag ordering

Docker flags can appear in any order: docker run --privileged ... and docker run -d --privileged ... both match because you're using CONTAINS "--privileged".

Check the rule against dev tooling

Some local development tools require privileged mode for volume features. Allowlist specific images by adding a higher-priority ALLOW rule for the exact image name:

rule allow-devcontainer-privileged {
  enabled true
  priority 200
  severity info
  ALLOW execution
  IF command CONTAINS "--privileged"
  AND command CONTAINS "my-trusted-devimage"
  MESSAGE "Trusted dev image is allowed to run privileged."
}