An internal file descriptor leak in runc, a CLI tool for spawning and running containers on Linux according to the OCI specification, allows for multiple container breakouts. The issue occurs because a file descriptor remains open during the `setcwd(2)` operation, even when `O CLOEXEC` is used on all descriptors before executing container code. An attacker can maintain a reference to the host filesystem by configuring the working directory to a path resolved through this leaked descriptor. This can be exploited via `runc exec` to set a working directory in the host filesystem namespace or via a malicious image using `runc run` to gain host filesystem access. Furthermore, these methods can be used to overwrite semi-arbitrary host binaries, leading to a complete container escape and arbitrary code execution on the host.