Pandora’s Container Part 1: Unpacking Azure Container Security

This blog post demonstrates practical attack techniques against Azure container services: enumerating ACR roles and credentials, enabling admin access, abusing ACR Tasks and managed identities to fetch Key Vault secrets, creating tokens/scope maps, and replacing container images with malicious Dockerfiles that steal IMDS tokens, exfiltrate secrets to webhooks or ngrok listeners, or establish reverse shells. It includes PoC commands, Dockerfiles, and mitigation recommendations such as enforcing least privilege, resource scoping, and MFA/Conditional Access.