[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71AFPX4TFX7SPCBQ30B2WTX":3,"skill-same:01M71AFPX4TFX7SPCBQ30B2WTX":76},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":55,"commitSha":56,"skillDirectory":57,"forksCount":58,"repositoryHtmlUrl":59,"repositoryHomepageUrl":6,"ownerHtmlUrl":60,"ownerBlogUrl":6,"ownerDescription":61,"updatedAt":62,"install":63,"resources":75},"01M71AFPX4TFX7SPCBQ30B2WTX","cyber-analyzing-docker-container-forensics",null,"Investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and evidence.","nexuslinkproductions\u002Fyuri-os","nexuslinkproductions","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F273246263?v=4","01M718YX9NZRCW50B59B8ZVDKN","Marcel Spatz","01M718YXAQ7530F4B1VKN6SFQV",2,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-analyzing-docker-container-forensics\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000016","图像与多媒体",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"analyzing docker container forensics","analyzing","docker","container","forensics","container forensics","cyber analyzing docker container forensics","image-analysis","container-security","de","container-forensics","apache","subdomain","malicious","logs","analysis","image","false","cybersecurity","images","2026-11-10 10:12:30",false,"---\nname: cyber-analyzing-docker-container-forensics\ndescription: \"Investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and evidence.\"\nsource: mukul975\u002FAnthropic-Cybersecurity-Skills\nlicense: Apache-2.0\nauthorized_lab: false\norigin_frontmatter: \"name: analyzing-docker-container-forensics | description: Investigate compromised Docker containers by analyzing images, layers, |   volumes, logs, and runtime artifacts to identify malicious activity and evidence. | domain: cybersecurity | subdomain: digital-forensics | tags: | - forensics | - docker | - container-forensics | - container-security | - image-analysis | - runtime-investigation | version: '1.0' | author: mahipal | license: Apache-2.0 | nist_csf: | - RS.AN-01 | - RS.AN-03 | - DE.AE-\"\nhide: true\n---\n\n> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Analyzing Docker Container Forensics\n\n## When to Use\n- When investigating a compromised Docker container or container host\n- For analyzing malicious Docker images pulled from registries\n- During incident response involving containerized application breaches\n- When examining container escape attempts or privilege escalation\n- For auditing container configurations and identifying misconfigurations\n\n## Prerequisites\n- Docker CLI access on the forensic workstation\n- Access to the Docker host file system (forensic image or live)\n- Understanding of Docker layered file system (overlay2, aufs)\n- dive, docker-explorer, or container-diff for image analysis\n- Knowledge of Docker daemon configuration and socket security\n- Trivy or Grype for vulnerability scanning of container images\n\n## Workflow\n\n### Step 1: Preserve Container State and Evidence\n\n```bash\n# List all containers (including stopped)\ndocker ps -a --no-trunc > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_list.txt\n\n# Inspect the compromised container\nCONTAINER_ID=\"abc123def456\"\ndocker inspect $CONTAINER_ID > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_inspect.json\n\n# Export container filesystem as tarball (preserves current state)\ndocker export $CONTAINER_ID > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_export.tar\n\n# Create an image from the container's current state\ndocker commit $CONTAINER_ID forensic-evidence:case-2024-001\ndocker save forensic-evidence:case-2024-001 > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_image.tar\n\n# Capture container logs\ndocker logs $CONTAINER_ID --timestamps > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_logs.txt 2>&1\n\n# Capture running processes (if container is still running)\ndocker top $CONTAINER_ID > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_processes.txt\n\n# Capture network connections\ndocker exec $CONTAINER_ID netstat -tlnp 2>\u002Fdev\u002Fnull > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_network.txt\n\n# Copy specific files from the container\ndocker cp $CONTAINER_ID:\u002Fvar\u002Flog\u002F \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_var_log\u002F\ndocker cp $CONTAINER_ID:\u002Ftmp\u002F \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_tmp\u002F\ndocker cp $CONTAINER_ID:\u002Fetc\u002Fpasswd \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_passwd\n\n# Hash all exported evidence\nsha256sum \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002F*.tar > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fevidence_hashes.txt\n```\n\n### Step 2: Analyze Container Image Layers\n\n```bash\n# Install dive for image layer analysis\nwget https:\u002F\u002Fgithub.com\u002Fwagoodman\u002Fdive\u002Freleases\u002Flatest\u002Fdownload\u002Fdive_linux_amd64.deb\nsudo dpkg -i dive_linux_amd64.deb\n\n# Analyze image layers interactively\ndive forensic-evidence:case-2024-001\n\n# Non-interactive layer analysis\ndive forensic-evidence:case-2024-001 --ci --json \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fdive_analysis.json\n\n# Extract and examine individual layers\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Flayers\u002F\ntar -xf \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_image.tar -C \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Flayers\u002F\n\n# List the image manifest and layer order\ncat \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Flayers\u002Fmanifest.json | python3 -m json.tool\n\n# Examine each layer for changes\nfor layer in \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Flayers\u002F*\u002Flayer.tar; do\n    echo \"=== Layer: $(dirname $layer | xargs basename) ===\"\n    tar -tf \"$layer\" | head -20\n    echo \"...\"\ndone\n\n# Use container-diff to compare with original base image\n# Install container-diff\ncurl -LO https:\u002F\u002Fstorage.googleapis.com\u002Fcontainer-diff\u002Flatest\u002Fcontainer-diff-linux-amd64\nchmod +x container-diff-linux-amd64\n\n# Compare committed image with original\n.\u002Fcontainer-diff-linux-amd64 diff daemon:\u002F\u002Fnginx:latest daemon:\u002F\u002Fforensic-evidence:case-2024-001 \\\n   --type=file --type=apt --type=history --json \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_diff.json\n```\n\n### Step 3: Examine Docker Host Artifacts\n\n```bash\n# Docker data directory (default: \u002Fvar\u002Flib\u002Fdocker\u002F)\nDOCKER_ROOT=\"\u002Fmnt\u002Fevidence\u002Fvar\u002Flib\u002Fdocker\"\n\n# Examine overlay2 filesystem layers\nls -la $DOCKER_ROOT\u002Foverlay2\u002F\n\n# Find the container's merged filesystem\nCONTAINER_HASH=$(docker inspect $CONTAINER_ID --format '{{.GraphDriver.Data.MergedDir}}' 2>\u002Fdev\u002Fnull)\n# Or manually from forensic image:\n# Look in \u002Fvar\u002Flib\u002Fdocker\u002Fcontainers\u002F\u003Ccontainer_id>\u002Fconfig.v2.json\n\n# Analyze container configuration files\ncat $DOCKER_ROOT\u002Fcontainers\u002F$CONTAINER_ID\u002Fconfig.v2.json | python3 -m json.tool \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_config.json\n\n# Check Docker daemon configuration\ncat \u002Fmnt\u002Fevidence\u002Fetc\u002Fdocker\u002Fdaemon.json 2>\u002Fdev\u002Fnull > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fdaemon_config.json\n\n# Examine Docker events log\ncat $DOCKER_ROOT\u002Fcontainers\u002F$CONTAINER_ID\u002F*.log > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_json_logs.txt\n\n# Check for volume mounts (potential host filesystem access)\npython3 \u003C\u003C 'PYEOF'\nimport json\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_inspect.json') as f:\n    data = json.load(f)\n\ninspect = data[0] if isinstance(data, list) else data\n\nprint(\"=== CONTAINER SECURITY ANALYSIS ===\\n\")\n\n# Check mounts\nprint(\"Volume Mounts:\")\nfor mount in inspect.get('Mounts', []):\n    rw = \"READ-WRITE\" if mount.get('RW') else \"READ-ONLY\"\n    print(f\"  {mount.get('Source', 'N\u002FA')} -> {mount.get('Destination', 'N\u002FA')} ({rw})\")\n    if mount.get('Source') in ('\u002F', '\u002Fetc', '\u002Fvar', '\u002Froot') and mount.get('RW'):\n        print(f\"    WARNING: Sensitive host path mounted read-write!\")\n\n# Check privileged mode\nhost_config = inspect.get('HostConfig', {})\nif host_config.get('Privileged'):\n    print(\"\\nWARNING: Container was running in PRIVILEGED mode!\")\n\n# Check capabilities\ncap_add = host_config.get('CapAdd', [])\nif cap_add:\n    print(f\"\\nAdded Capabilities: {cap_add}\")\n    dangerous_caps = ['SYS_ADMIN', 'SYS_PTRACE', 'NET_ADMIN', 'SYS_MODULE']\n    for cap in cap_add:\n        if cap in dangerous_caps:\n            print(f\"  WARNING: Dangerous capability: {cap}\")\n\n# Check PID namespace\nif host_config.get('PidMode') == 'host':\n    print(\"\\nWARNING: Container shares host PID namespace!\")\n\n# Check network mode\nif host_config.get('NetworkMode') == 'host':\n    print(\"\\nWARNING: Container shares host network namespace!\")\n\n# Check user\nuser = inspect.get('Config', {}).get('User', 'root (default)')\nprint(f\"\\nRunning as user: {user}\")\n\n# Check environment variables for secrets\nenv_vars = inspect.get('Config', {}).get('Env', [])\nprint(f\"\\nEnvironment Variables: {len(env_vars)}\")\nfor env in env_vars:\n    key = env.split('=')[0]\n    if any(s in key.upper() for s in ['PASSWORD', 'SECRET', 'KEY', 'TOKEN', 'CREDENTIAL']):\n        print(f\"  SENSITIVE: {key}=***REDACTED***\")\nPYEOF\n```\n\n### Step 4: Analyze Container File System Changes\n\n```bash\n# Compare container filesystem to original image\ndocker diff $CONTAINER_ID > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Ffilesystem_changes.txt\n\n# A = Added, C = Changed, D = Deleted\n# Analyze changes\npython3 \u003C\u003C 'PYEOF'\nadded = []\nchanged = []\ndeleted = []\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Ffilesystem_changes.txt') as f:\n    for line in f:\n        line = line.strip()\n        if line.startswith('A '):\n            added.append(line[2:])\n        elif line.startswith('C '):\n            changed.append(line[2:])\n        elif line.startswith('D '):\n            deleted.append(line[2:])\n\nprint(f\"Files Added: {len(added)}\")\nprint(f\"Files Changed: {len(changed)}\")\nprint(f\"Files Deleted: {len(deleted)}\")\n\n# Flag suspicious additions\nsuspicious = [f for f in added if any(s in f for s in\n    ['\u002Ftmp\u002F', '\u002Fdev\u002Fshm\u002F', '\u002Froot\u002F', '.sh', '.py', '.elf', 'reverse', 'shell', 'backdoor'])]\nif suspicious:\n    print(f\"\\nSuspicious Added Files:\")\n    for f in suspicious:\n        print(f\"  {f}\")\n\n# Flag suspicious changes\nsus_changed = [f for f in changed if any(s in f for s in\n    ['\u002Fetc\u002Fpasswd', '\u002Fetc\u002Fshadow', '\u002Fetc\u002Fcrontab', '\u002Fetc\u002Fssh', '.bashrc'])]\nif sus_changed:\n    print(f\"\\nSuspicious Changed Files:\")\n    for f in sus_changed:\n        print(f\"  {f}\")\nPYEOF\n\n# Extract and examine the container export\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_fs\u002F\ntar -xf \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_export.tar -C \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_fs\u002F\n\n# Scan for webshells and malicious files\nfind \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_fs\u002Ftmp\u002F -type f -exec file {} \\;\nfind \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_fs\u002F -name \"*.php\" -newer \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_fs\u002Fetc\u002Fhostname\n```\n\n### Step 5: Scan for Vulnerabilities and Generate Report\n\n```bash\n# Scan the image for known vulnerabilities\ntrivy image forensic-evidence:case-2024-001 \\\n   --format json \\\n   --output \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fvulnerability_scan.json\n\n# Scan the exported filesystem\ntrivy fs \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_fs\u002F \\\n   --format table \\\n   --output \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Ffs_vulnerabilities.txt\n\n# Check for secrets in the image\ntrivy image forensic-evidence:case-2024-001 \\\n   --scanners secret \\\n   --format json \\\n   --output \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fsecrets_scan.json\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Image layers | Read-only filesystem layers stacked to form the container image |\n| overlay2 | Default Docker storage driver using union filesystem for layers |\n| Container diff | Comparison of runtime filesystem changes against the original image |\n| Privileged mode | Container with full host capabilities (bypasses most isolation) |\n| Docker socket | Unix socket (\u002Fvar\u002Frun\u002Fdocker.sock) controlling the Docker daemon |\n| Container escape | Technique for breaking out of container isolation to the host |\n| Volume mounts | Host filesystem paths made accessible inside the container |\n| Image history | Record of Dockerfile instructions used to build each layer |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| docker inspect | Detailed container configuration and state information |\n| docker diff | Show filesystem changes made in a running\u002Fstopped container |\n| dive | Interactive Docker image layer analysis tool |\n| container-diff | Google tool for comparing container image contents |\n| Trivy | Vulnerability scanner for container images and filesystems |\n| docker-explorer | Forensic tool for offline Docker artifact analysis |\n| Sysdig | Container runtime security monitoring and forensics |\n| Falco | Runtime threat detection for containers and Kubernetes |\n\n## Common Scenarios\n\n**Scenario 1: Web Application Container Compromise**\nExport the container filesystem, identify webshells in web root, analyze access logs for exploitation attempts, check for added files and modified configurations, examine network connections for C2 communication, review container capabilities for escalation paths.\n\n**Scenario 2: Supply Chain Attack via Malicious Image**\nAnalyze image layers with dive to identify which layer added malicious content, compare with the official base image using container-diff, check image history for suspicious RUN commands, scan for embedded backdoors and cryptocurrency miners, trace the image pull from registry logs.\n\n**Scenario 3: Container Escape Investigation**\nCheck if container ran privileged or with dangerous capabilities, examine host filesystem mount points for unauthorized access, review Docker socket mount enabling Docker-in-Docker abuse, analyze host system logs for container escape indicators, check for kernel exploit artifacts.\n\n**Scenario 4: Cryptojacking in Container Environment**\nIdentify high-CPU containers, export and analyze the container image for mining binaries, check for unauthorized images in the registry, review container creation events for rogue deployments, examine network connections for mining pool communications.\n\n## Output Format\n\n```\nDocker Container Forensics Summary:\n  Container: abc123def456 (nginx-app)\n  Image: company\u002Fweb-app:v2.1\n  Status: Running (started 2024-01-10 09:00 UTC)\n  Host: docker-host-01.corp.local\n\n  Security Configuration:\n    Privileged: No\n    Capabilities Added: NET_ADMIN (WARNING)\n    Volume Mounts: \u002Fvar\u002Flog -> \u002Fhost-logs (RW)\n    Network Mode: bridge\n    User: root (WARNING)\n\n  Filesystem Changes:\n    Added: 23 files (5 suspicious)\n    Changed: 12 files (2 suspicious)\n    Deleted: 0 files\n\n  Suspicious Findings:\n    \u002Ftmp\u002Freverse.sh - Reverse shell script (Added)\n    \u002Fvar\u002Fwww\u002Fhtml\u002F.hidden\u002Fshell.php - PHP webshell (Added)\n    \u002Fetc\u002Fcrontab - Modified (persistence cron entry added)\n    \u002Froot\u002F.ssh\u002Fauthorized_keys - Modified (unauthorized key added)\n\n  Vulnerability Scan:\n    Critical: 3 (CVE-2024-xxxx in base image)\n    High: 12\n    Medium: 34\n\n  Evidence: \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002F\n```\n","> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Analyzing Docker Container Forensics\n\n## When to Use\n- When investigating a compromised Docker container or container host\n- For analyzing malicious Docker images pulled from registries\n- During incident response involving containerized application breaches\n- When examining container escape attempts or privilege escalation\n- For auditing container configurations and identifying misconfigurations\n\n## Prerequisites\n- Docker CLI access on the forensic workstation\n- Access to the Docker host file system (forensic image or live)\n- Understanding of Docker layered file system (overlay2, aufs)\n- dive, docker-explorer, or container-diff for image analysis\n- Knowledge of Docker daemon configuration and socket security\n- Trivy or Grype for vulnerability scanning of container images\n\n## Workflow\n\n### Step 1: Preserve Container State and Evidence\n\n```bash\n# List all containers (including stopped)\ndocker ps -a --no-trunc > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_list.txt\n\n# Inspect the compromised container\nCONTAINER_ID=\"abc123def456\"\ndocker inspect $CONTAINER_ID > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_inspect.json\n\n# Export container filesystem as tarball (preserves current state)\ndocker export $CONTAINER_ID > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_export.tar\n\n# Create an image from the container's current state\ndocker commit $CONTAINER_ID forensic-evidence:case-2024-001\ndocker save forensic-evidence:case-2024-001 > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_image.tar\n\n# Capture container logs\ndocker logs $CONTAINER_ID --timestamps > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_logs.txt 2>&1\n\n# Capture running processes (if container is still running)\ndocker top $CONTAINER_ID > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_processes.txt\n\n# Capture network connections\ndocker exec $CONTAINER_ID netstat -tlnp 2>\u002Fdev\u002Fnull > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_network.txt\n\n# Copy specific files from the container\ndocker cp $CONTAINER_ID:\u002Fvar\u002Flog\u002F \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_var_log\u002F\ndocker cp $CONTAINER_ID:\u002Ftmp\u002F \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_tmp\u002F\ndocker cp $CONTAINER_ID:\u002Fetc\u002Fpasswd \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_passwd\n\n# Hash all exported evidence\nsha256sum \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002F*.tar > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fevidence_hashes.txt\n```\n\n### Step 2: Analyze Container Image Layers\n\n```bash\n# Install dive for image layer analysis\nwget https:\u002F\u002Fgithub.com\u002Fwagoodman\u002Fdive\u002Freleases\u002Flatest\u002Fdownload\u002Fdive_linux_amd64.deb\nsudo dpkg -i dive_linux_amd64.deb\n\n# Analyze image layers interactively\ndive forensic-evidence:case-2024-001\n\n# Non-interactive layer analysis\ndive forensic-evidence:case-2024-001 --ci --json \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fdive_analysis.json\n\n# Extract and examine individual layers\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Flayers\u002F\ntar -xf \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_image.tar -C \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Flayers\u002F\n\n# List the image manifest and layer order\ncat \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Flayers\u002Fmanifest.json | python3 -m json.tool\n\n# Examine each layer for changes\nfor layer in \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Flayers\u002F*\u002Flayer.tar; do\n    echo \"=== Layer: $(dirname $layer | xargs basename) ===\"\n    tar -tf \"$layer\" | head -20\n    echo \"...\"\ndone\n\n# Use container-diff to compare with original base image\n# Install container-diff\ncurl -LO https:\u002F\u002Fstorage.googleapis.com\u002Fcontainer-diff\u002Flatest\u002Fcontainer-diff-linux-amd64\nchmod +x container-diff-linux-amd64\n\n# Compare committed image with original\n.\u002Fcontainer-diff-linux-amd64 diff daemon:\u002F\u002Fnginx:latest daemon:\u002F\u002Fforensic-evidence:case-2024-001 \\\n   --type=file --type=apt --type=history --json \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_diff.json\n```\n\n### Step 3: Examine Docker Host Artifacts\n\n```bash\n# Docker data directory (default: \u002Fvar\u002Flib\u002Fdocker\u002F)\nDOCKER_ROOT=\"\u002Fmnt\u002Fevidence\u002Fvar\u002Flib\u002Fdocker\"\n\n# Examine overlay2 filesystem layers\nls -la $DOCKER_ROOT\u002Foverlay2\u002F\n\n# Find the container's merged filesystem\nCONTAINER_HASH=$(docker inspect $CONTAINER_ID --format '{{.GraphDriver.Data.MergedDir}}' 2>\u002Fdev\u002Fnull)\n# Or manually from forensic image:\n# Look in \u002Fvar\u002Flib\u002Fdocker\u002Fcontainers\u002F\u003Ccontainer_id>\u002Fconfig.v2.json\n\n# Analyze container configuration files\ncat $DOCKER_ROOT\u002Fcontainers\u002F$CONTAINER_ID\u002Fconfig.v2.json | python3 -m json.tool \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_config.json\n\n# Check Docker daemon configuration\ncat \u002Fmnt\u002Fevidence\u002Fetc\u002Fdocker\u002Fdaemon.json 2>\u002Fdev\u002Fnull > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fdaemon_config.json\n\n# Examine Docker events log\ncat $DOCKER_ROOT\u002Fcontainers\u002F$CONTAINER_ID\u002F*.log > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_json_logs.txt\n\n# Check for volume mounts (potential host filesystem access)\npython3 \u003C\u003C 'PYEOF'\nimport json\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_inspect.json') as f:\n    data = json.load(f)\n\ninspect = data[0] if isinstance(data, list) else data\n\nprint(\"=== CONTAINER SECURITY ANALYSIS ===\\n\")\n\n# Check mounts\nprint(\"Volume Mounts:\")\nfor mount in inspect.get('Mounts', []):\n    rw = \"READ-WRITE\" if mount.get('RW') else \"READ-ONLY\"\n    print(f\"  {mount.get('Source', 'N\u002FA')} -> {mount.get('Destination', 'N\u002FA')} ({rw})\")\n    if mount.get('Source') in ('\u002F', '\u002Fetc', '\u002Fvar', '\u002Froot') and mount.get('RW'):\n        print(f\"    WARNING: Sensitive host path mounted read-write!\")\n\n# Check privileged mode\nhost_config = inspect.get('HostConfig', {})\nif host_config.get('Privileged'):\n    print(\"\\nWARNING: Container was running in PRIVILEGED mode!\")\n\n# Check capabilities\ncap_add = host_config.get('CapAdd', [])\nif cap_add:\n    print(f\"\\nAdded Capabilities: {cap_add}\")\n    dangerous_caps = ['SYS_ADMIN', 'SYS_PTRACE', 'NET_ADMIN', 'SYS_MODULE']\n    for cap in cap_add:\n        if cap in dangerous_caps:\n            print(f\"  WARNING: Dangerous capability: {cap}\")\n\n# Check PID namespace\nif host_config.get('PidMode') == 'host':\n    print(\"\\nWARNING: Container shares host PID namespace!\")\n\n# Check network mode\nif host_config.get('NetworkMode') == 'host':\n    print(\"\\nWARNING: Container shares host network namespace!\")\n\n# Check user\nuser = inspect.get('Config', {}).get('User', 'root (default)')\nprint(f\"\\nRunning as user: {user}\")\n\n# Check environment variables for secrets\nenv_vars = inspect.get('Config', {}).get('Env', [])\nprint(f\"\\nEnvironment Variables: {len(env_vars)}\")\nfor env in env_vars:\n    key = env.split('=')[0]\n    if any(s in key.upper() for s in ['PASSWORD', 'SECRET', 'KEY', 'TOKEN', 'CREDENTIAL']):\n        print(f\"  SENSITIVE: {key}=***REDACTED***\")\nPYEOF\n```\n\n### Step 4: Analyze Container File System Changes\n\n```bash\n# Compare container filesystem to original image\ndocker diff $CONTAINER_ID > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Ffilesystem_changes.txt\n\n# A = Added, C = Changed, D = Deleted\n# Analyze changes\npython3 \u003C\u003C 'PYEOF'\nadded = []\nchanged = []\ndeleted = []\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Ffilesystem_changes.txt') as f:\n    for line in f:\n        line = line.strip()\n        if line.startswith('A '):\n            added.append(line[2:])\n        elif line.startswith('C '):\n            changed.append(line[2:])\n        elif line.startswith('D '):\n            deleted.append(line[2:])\n\nprint(f\"Files Added: {len(added)}\")\nprint(f\"Files Changed: {len(changed)}\")\nprint(f\"Files Deleted: {len(deleted)}\")\n\n# Flag suspicious additions\nsuspicious = [f for f in added if any(s in f for s in\n    ['\u002Ftmp\u002F', '\u002Fdev\u002Fshm\u002F', '\u002Froot\u002F', '.sh', '.py', '.elf', 'reverse', 'shell', 'backdoor'])]\nif suspicious:\n    print(f\"\\nSuspicious Added Files:\")\n    for f in suspicious:\n        print(f\"  {f}\")\n\n# Flag suspicious changes\nsus_changed = [f for f in changed if any(s in f for s in\n    ['\u002Fetc\u002Fpasswd', '\u002Fetc\u002Fshadow', '\u002Fetc\u002Fcrontab', '\u002Fetc\u002Fssh', '.bashrc'])]\nif sus_changed:\n    print(f\"\\nSuspicious Changed Files:\")\n    for f in sus_changed:\n        print(f\"  {f}\")\nPYEOF\n\n# Extract and examine the container export\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_fs\u002F\ntar -xf \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_export.tar -C \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_fs\u002F\n\n# Scan for webshells and malicious files\nfind \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_fs\u002Ftmp\u002F -type f -exec file {} \\;\nfind \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_fs\u002F -name \"*.php\" -newer \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_fs\u002Fetc\u002Fhostname\n```\n\n### Step 5: Scan for Vulnerabilities and Generate Report\n\n```bash\n# Scan the image for known vulnerabilities\ntrivy image forensic-evidence:case-2024-001 \\\n   --format json \\\n   --output \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fvulnerability_scan.json\n\n# Scan the exported filesystem\ntrivy fs \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_fs\u002F \\\n   --format table \\\n   --output \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Ffs_vulnerabilities.txt\n\n# Check for secrets in the image\ntrivy image forensic-evidence:case-2024-001 \\\n   --scanners secret \\\n   --format json \\\n   --output \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fsecrets_scan.json\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Image layers | Read-only filesystem layers stacked to form the container image |\n| overlay2 | Default Docker storage driver using union filesystem for layers |\n| Container diff | Comparison of runtime filesystem changes against the original image |\n| Privileged mode | Container with full host capabilities (bypasses most isolation) |\n| Docker socket | Unix socket (\u002Fvar\u002Frun\u002Fdocker.sock) controlling the Docker daemon |\n| Container escape | Technique for breaking out of container isolation to the host |\n| Volume mounts | Host filesystem paths made accessible inside the container |\n| Image history | Record of Dockerfile instructions used to build each layer |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| docker inspect | Detailed container configuration and state information |\n| docker diff | Show filesystem changes made in a running\u002Fstopped container |\n| dive | Interactive Docker image layer analysis tool |\n| container-diff | Google tool for comparing container image contents |\n| Trivy | Vulnerability scanner for container images and filesystems |\n| docker-explorer | Forensic tool for offline Docker artifact analysis |\n| Sysdig | Container runtime security monitoring and forensics |\n| Falco | Runtime threat detection for containers and Kubernetes |\n\n## Common Scenarios\n\n**Scenario 1: Web Application Container Compromise**\nExport the container filesystem, identify webshells in web root, analyze access logs for exploitation attempts, check for added files and modified configurations, examine network connections for C2 communication, review container capabilities for escalation paths.\n\n**Scenario 2: Supply Chain Attack via Malicious Image**\nAnalyze image layers with dive to identify which layer added malicious content, compare with the official base image using container-diff, check image history for suspicious RUN commands, scan for embedded backdoors and cryptocurrency miners, trace the image pull from registry logs.\n\n**Scenario 3: Container Escape Investigation**\nCheck if container ran privileged or with dangerous capabilities, examine host filesystem mount points for unauthorized access, review Docker socket mount enabling Docker-in-Docker abuse, analyze host system logs for container escape indicators, check for kernel exploit artifacts.\n\n**Scenario 4: Cryptojacking in Container Environment**\nIdentify high-CPU containers, export and analyze the container image for mining binaries, check for unauthorized images in the registry, review container creation events for rogue deployments, examine network connections for mining pool communications.\n\n## Output Format\n\n```\nDocker Container Forensics Summary:\n  Container: abc123def456 (nginx-app)\n  Image: company\u002Fweb-app:v2.1\n  Status: Running (started 2024-01-10 09:00 UTC)\n  Host: docker-host-01.corp.local\n\n  Security Configuration:\n    Privileged: No\n    Capabilities Added: NET_ADMIN (WARNING)\n    Volume Mounts: \u002Fvar\u002Flog -> \u002Fhost-logs (RW)\n    Network Mode: bridge\n    User: root (WARNING)\n\n  Filesystem Changes:\n    Added: 23 files (5 suspicious)\n    Changed: 12 files (2 suspicious)\n    Deleted: 0 files\n\n  Suspicious Findings:\n    \u002Ftmp\u002Freverse.sh - Reverse shell script (Added)\n    \u002Fvar\u002Fwww\u002Fhtml\u002F.hidden\u002Fshell.php - PHP webshell (Added)\n    \u002Fetc\u002Fcrontab - Modified (persistence cron entry added)\n    \u002Froot\u002F.ssh\u002Fauthorized_keys - Modified (unauthorized key added)\n\n  Vulnerability Scan:\n    Critical: 3 (CVE-2024-xxxx in base image)\n    High: 12\n    Medium: 34\n\n  Evidence: \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002F\n```\n",{"hide":52,"name":5,"source":53,"license":15,"description":7,"authorized_lab":48,"origin_frontmatter":54},true,"mukul975\u002FAnthropic-Cybersecurity-Skills","name: analyzing-docker-container-forensics | description: Investigate compromised Docker containers by analyzing images, layers, |   volumes, logs, and runtime artifacts to identify malicious activity and evidence. | domain: cybersecurity | subdomain: digital-forensics | tags: | - forensics | - docker | - container-forensics | - container-security | - image-analysis | - runtime-investigation | version: '1.0' | author: mahipal | license: Apache-2.0 | nist_csf: | - RS.AN-01 | - RS.AN-03 | - DE.AE-","main","4c6d8d65f3d6096e2fc25b0845e481dda73c2794",".claude\u002Fskills\u002Fcyber-analyzing-docker-container-forensics",0,"https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions","Building deterministic AI governance and continuity systems. Workflow architect + visual storyteller","2026-10-27 02:18:29",{"source":8,"skillName":5,"commands":64,"prompt":74,"zipAvailable":52},[65,68,71],{"tool":66,"command":67},"npx","npx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-analyzing-docker-container-forensics",{"tool":69,"command":70},"bunx","bunx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-analyzing-docker-container-forensics",{"tool":72,"command":73},"pnpm","pnpm dlx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-analyzing-docker-container-forensics","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-analyzing-docker-container-forensics\u002FSKILL.md",[],[77,101,125,153,182,201],{"skillNo":78,"name":79,"nameZh":6,"description":80,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":81,"licenseFileUrl":6,"sourceHtmlUrl":82,"categories":83,"keywords":84,"publishedAt":47},"01M71CG1AME5WC0A79AE65WT0X","zoom-out","Tell the agent to zoom out and give broader context or a higher-level perspective. Use when you're unfamiliar with a section of code or need to understand how it fits into the bigger picture.","MIT","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fzoom-out\u002FSKILL.md",[],[85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100],"zoom out","zoom","with","harness","how","section","re","true","understand","use","perspective","when","you","code","it","context",{"skillNo":102,"name":103,"nameZh":6,"description":104,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":81,"licenseFileUrl":6,"sourceHtmlUrl":105,"categories":106,"keywords":107,"publishedAt":47},"01M71CFY9ATD0BAXV6B14HFG7C","yuri-shura","6-perspective adversarial review for high-stakes turns (architecture decisions, refactor planning, deployment review) — fans out architect, adversary (7-vector attack), maintainer, ops, product, and security perspectives in parallel, then consolidates. Use when user says 'review this decision', '\u002Fshura', 'adversarial review', 'what could go wrong', 'architecture review', or 'deployment review'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-shura\u002FSKILL.md",[],[108,109,88,110,111,112,113,114,115,116,117,94,118,96,119,120,121,122,123,124],"yuri shura","parallel","architecture review","planning","for","deployment","vector","strategic review","decision","strategic","ops","workflow","decisions","architecture","review","perspectives","adversarial",{"skillNo":126,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":81,"licenseFileUrl":6,"sourceHtmlUrl":129,"categories":130,"keywords":134,"publishedAt":47},"01M71CFTTYW1HA2MNX38EV1GJ5","yuri-sales-intelligence","Unified sales and outreach skill generating cold outreach openers, social selling sequences, objection rebuttals, and ad creative for any paid platform — multi-persona aware, adapting tone and offer frame to buyer type. Use when user says 'write a cold email', 'outreach sequence', 'objection handling', 'ad copy', or 'sales pitch'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-sales-intelligence\u002FSKILL.md",[131],{"categoryNo":132,"categoryName":133,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000005","邮件与沟通",[135,136,137,138,139,140,141,142,143,96,144,145,146,147,148,149,150,112,151,152],"intelligence","sales intelligence","yuri sales intelligence","sales","cold","paid","social","persona","pitch","cold email","ad creative","write","sequences","sequence","platform","email","cold outreach","frame",{"skillNo":154,"name":155,"nameZh":6,"description":156,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":81,"licenseFileUrl":6,"sourceHtmlUrl":157,"categories":158,"keywords":167,"publishedAt":47},"01M71CFQMBFTFADJNGP0Z2WCYK","yuri-code-intelligence","Unified code quality intelligence layer that diagnoses code smells (Long Method, Feature Envy, design pattern issues), prescribes targeted Fowler refactoring techniques, and reviews code for security, performance, and clarity. Use when user says 'review this code', 'refactor this', 'what's wrong with this method', 'code smells', or 'clean this up'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-code-intelligence\u002FSKILL.md",[159,162],{"categoryNo":160,"categoryName":161,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":163,"categoryName":164,"taxonomyType":165,"taxonomyTypeDesc":166},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[168,98,169,135,88,170,171,172,112,173,174,175,176,177,178,179,180,181,94,96],"yuri code intelligence","code intelligence","reviews","code quality","feature","performance","code review","long","up","issues","clean","techniques","improve","design",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":81,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":188,"publishedAt":47},"01M71CFP32RT6GD3GKNHCJP8VP","yuri-adw","Invoke when user asks to run the ADW loop \u002F agentic engineering loop \u002F software factory workflow.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-adw\u002FSKILL.md",[],[189,190,191,192,193,194,195,196,197,96,198,119,199,200],"yuri adw","run","engineering loop","software factory","software","agentic engineering","factory","loop","invoke","engineering","agentic","user",{"skillNo":202,"name":203,"nameZh":6,"description":204,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":81,"licenseFileUrl":6,"sourceHtmlUrl":205,"categories":206,"keywords":219,"publishedAt":47},"01M71CFK4VPEKY6A73237P7RSN","writing-skills","Use when creating new skills, editing existing skills, or verifying skills work before deployment","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fwriting-skills\u002FSKILL.md",[207,210,213,216],{"categoryNo":208,"categoryName":209,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":211,"categoryName":212,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":214,"categoryName":215,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":217,"categoryName":218,"taxonomyType":165,"taxonomyTypeDesc":166},"01JBSEEDCAT000000000000036","内容创作者",[220,221,222,96,119,223,88,224,113,94,225],"writing","writing skills","new","work","editing","Existing"]