CopyEscape

An educational proof of concept of the CopyEscape chain (CVE-2026-17106): a TOCTOU race condition in the tar extraction of docker cp (a Docker CLI bug, patched in 29.7.0) lets a container without extra capabilities write arbitrary files on the host through an absolute symlink with an atomic rename(2) pivot and rollback. The Linux variant overwrites /usr/bin/runc and achieves root code execution; the macOS variant is a harmless demo that writes ~/pwnd. Includes an LD_PRELOAD, an inotify monitor and a reproducible Docker lab. For educational and research purposes only.