What's worse than escaping a sandbox and reading the host's files? Escaping Cloudflare's, and reading other customers' files. How did that happen? Cloudflare Containers' disk is thin-provisioned, which means the host keeps a shared pool of storage for every container on the machine, and attaches it lazily in 64 KB chunks, instead of provisioning it all upfront. When we tried reading a chunk of unallocated disk space in a container, we got zeros, which is to be expected. But we noticed something strange: the chunks that we already wrote to were full of bytes we didn't write. Turns out a write is what makes the thin provisioner allocate the chunk, and Cloudflare wasn't zeroing it on the way in, so the rest of the chunk still held leftover data from the previous customers' containers that happened to run the same machine. By writing 4 KB to every chunk of the disk. The other 60 KB of each chunk were instantly filled with other customers' files: .env, credential files, .pem keys, SQLite databases, Chromium cookies and localStorage. I've disclosed vulnerabilities to many vendors over the years, but working with Cloudflare was something else. Putting aside the speedy triage, mitigation, and generous bounty, they have a unique and earnest engineering culture of transparency. Which lead to us collaborating and writing the full postmortem together: blog.cloudflare.com/containe…