Methods for Establishing Covert Outbound Connections from Locked-Down Containers

What "no network" actually means

A container rarely has no network. What it has is a policy: a set of rules about which traffic may leave, written in iptables or nftables or a CNI plugin, and applied at the host or the pod level. The policy is a list of permits and denies, and like every list it has a shape: DNS is usually permitted (something must resolve names), the resolver it points to is reachable, a sidecar or logging daemon may share the namespace, and a small set of destinations — package mirrors, a metrics endpoint, a gateway — are allowlisted because the workload needs them.

Each permitted channel is a door, and doors have the property that they carry whatever fits through them. The resolver that answers 'A' queries will also answer 'TXT' queries, and the queries are just UDP packets with arbitrary payload fields; a sidecar that ships logs accepts whatever the process writes to its socket; a namespace shared with another container is shared with everything that container can reach; an allowlisted CDN serves arbitrary paths, including ones you control.

The point of cataloguing these is not that any single seam is a magic tunnel — it is that "no network" is a policy about destinations, not a property of the container, and policies are only as complete as their authors. The gaps people chase — a permitted resolver, a sidecar, a shared namespace — are all failur