A Docker escape is a breakout from a container boundary, where code running inside a container gains access to the host system or to other isolated workloads. It matters because containers share the host kernel: if an attacker reaches a kernel bug, a misconfigured runtime feature, or a privileged container path, the isolation promised by Docker can fail.
In real attacks, escapes often start with local privilege escalation inside the container and then pivot through the kernel, mounted host filesystems, dangerous capabilities, or exposed device and socket interfaces. Defensive controls focus on reducing what containers can touch: run rootless when possible, drop unnecessary capabilities, avoid privileged containers, limit host mounts, and keep the host kernel patched. In the context of kernel flaws such as AF_ALG races, a Docker escape is possible when the vulnerable interface is reachable from the container and the bug allows control of host-side memory or state.