<p>In recent years, cloud-native technologies have rapidly penetrated containerized environments. Their lightweight, flexible, and portable features have made them highly popular among developers. However, the extensive use of containers has also made them a prime target for network attacks, with container vulnerabilities and dangerous mounts frequently leading to container escapes. To address this, this paper proposes a new method that combines eBPF-based multi-level container behavior monitoring with LLM-based anomaly detection. Probes are deployed in the system kernel to conduct multi-level monitoring of container system activities, call features, and behavior logs. The strong semantic understanding and pattern-recognition capabilities of LLMs are utilized to uncover hidden features and abnormal behaviors in the data, enabling precise detection of container issues. Specifically, lightweight eBPF probes are deployed in Linux kernel Namespaces and Cgroups. By parsing node identifiers (Node IDs) in Cgroup hierarchy management and the process isolation features of PID/UID Namespaces, a monitoring chain for cross-host container interactions is constructed. This enables non-intrusive collection of file operations, system calls, and network traffic. During data processing, a dual-window partitioning mechanism and a feature extraction framework based on event type distribution and time-series dependencies are employed. In the behavior analysis layer, we designed a three-layer Chain-of-Thought (CoT) prompt template ("Question-Reasoning-Answer"). Container behavior logs are converted into natural language reasoning chains and embedded into a Q-A-formatted dataset with logical reasoning chains. The Qwen1.5-1.8B-Chat model is fine-tuned using Low-Rank Adaptation (LoRA) technology. Experimental results show that this method performs excellently in container escape anomaly identification scenarios, achieving a detection accuracy of 99.22% in simulated malicious attack scenarios.</p>