Bulkhead: Automated Semantic Detection and Remediation of Container Escape Vulnerabilities.

arXiv:2607.12723v2 Announce Type: replace-cross Abstract: Container filesystem isolation depends on safely resolving container-controlled paths during privileged host-container interactions. As third-party plugins and agent sandboxes introduce more interaction