[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7B4P32VJS894RAQNTP4CWB0":3,"skill-same:01M7B4P32VJS894RAQNTP4CWB0":80},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":15,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":44,"commitSha":45,"skillDirectory":46,"forksCount":13,"repositoryHtmlUrl":47,"repositoryHomepageUrl":6,"ownerHtmlUrl":48,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":49,"install":50,"resources":63},"01M7B4P32VJS894RAQNTP4CWB0","analyzing-docker-container-forensics",null,"Investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and evidence.","vikasvardhanv\u002Fjerry_skills","vikasvardhanv","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F99010657?v=4","01M7B2B0VN78W7529RQX5BR6DZ","01M7B2B0WDNTXJHRK3QNPNWRP6",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fcurated_premium_skills\u002FAnthropic-Cybersecurity-Skills\u002Fskills\u002Fanalyzing-docker-container-forensics\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fcurated_premium_skills\u002FAnthropic-Cybersecurity-Skills\u002Fskills\u002Fanalyzing-docker-container-forensics\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: analyzing-docker-container-forensics\ndescription: Investigate compromised Docker containers by analyzing images, layers,\n  volumes, logs, and runtime artifacts to identify malicious activity and evidence.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- forensics\n- docker\n- container-forensics\n- container-security\n- image-analysis\n- runtime-investigation\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.AN-03\n- DE.AE-02\n- RS.MA-01\nmitre_attack:\n- T1610\n- T1611\n- T1613\n- T1612\n---\n\n# Analyzing Docker Container Forensics\n\n## When to Use\n- When investigating a compromised Docker container or container host\n- For analyzing malicious Docker images pulled from registries\n- During incident response involving containerized application breaches\n- When examining container escape attempts or privilege escalation\n- For auditing container configurations and identifying misconfigurations\n\n## Prerequisites\n- Docker CLI access on the forensic workstation\n- Access to the Docker host file system (forensic image or live)\n- Understanding of Docker layered file system (overlay2, aufs)\n- dive, docker-explorer, or container-diff for image analysis\n- Knowledge of Docker daemon configuration and socket security\n- Trivy or Grype for vulnerability scanning of container images\n\n## Workflow\n\n### Step 1: Preserve Container State and Evidence\n\n```bash\n# List all containers (including stopped)\ndocker ps -a --no-trunc > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_list.txt\n\n# Inspect the compromised container\nCONTAINER_ID=\"abc123def456\"\ndocker inspect $CONTAINER_ID > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_inspect.json\n\n# Export container filesystem as tarball (preserves current state)\ndocker export $CONTAINER_ID > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_export.tar\n\n# Create an image from the container's current state\ndocker commit $CONTAINER_ID forensic-evidence:case-2024-001\ndocker save forensic-evidence:case-2024-001 > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_image.tar\n\n# Capture container logs\ndocker logs $CONTAINER_ID --timestamps > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_logs.txt 2>&1\n\n# Capture running processes (if container is still running)\ndocker top $CONTAINER_ID > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_processes.txt\n\n# Capture network connections\ndocker exec $CONTAINER_ID netstat -tlnp 2>\u002Fdev\u002Fnull > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_network.txt\n\n# Copy specific files from the container\ndocker cp $CONTAINER_ID:\u002Fvar\u002Flog\u002F \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_var_log\u002F\ndocker cp $CONTAINER_ID:\u002Ftmp\u002F \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_tmp\u002F\ndocker cp $CONTAINER_ID:\u002Fetc\u002Fpasswd \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_passwd\n\n# Hash all exported evidence\nsha256sum \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002F*.tar > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fevidence_hashes.txt\n```\n\n### Step 2: Analyze Container Image Layers\n\n```bash\n# Install dive for image layer analysis\nwget https:\u002F\u002Fgithub.com\u002Fwagoodman\u002Fdive\u002Freleases\u002Flatest\u002Fdownload\u002Fdive_linux_amd64.deb\nsudo dpkg -i dive_linux_amd64.deb\n\n# Analyze image layers interactively\ndive forensic-evidence:case-2024-001\n\n# Non-interactive layer analysis\ndive forensic-evidence:case-2024-001 --ci --json \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fdive_analysis.json\n\n# Extract and examine individual layers\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Flayers\u002F\ntar -xf \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_image.tar -C \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Flayers\u002F\n\n# List the image manifest and layer order\ncat \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Flayers\u002Fmanifest.json | python3 -m json.tool\n\n# Examine each layer for changes\nfor layer in \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Flayers\u002F*\u002Flayer.tar; do\n    echo \"=== Layer: $(dirname $layer | xargs basename) ===\"\n    tar -tf \"$layer\" | head -20\n    echo \"...\"\ndone\n\n# Use container-diff to compare with original base image\n# Install container-diff\ncurl -LO https:\u002F\u002Fstorage.googleapis.com\u002Fcontainer-diff\u002Flatest\u002Fcontainer-diff-linux-amd64\nchmod +x container-diff-linux-amd64\n\n# Compare committed image with original\n.\u002Fcontainer-diff-linux-amd64 diff daemon:\u002F\u002Fnginx:latest daemon:\u002F\u002Fforensic-evidence:case-2024-001 \\\n   --type=file --type=apt --type=history --json \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_diff.json\n```\n\n### Step 3: Examine Docker Host Artifacts\n\n```bash\n# Docker data directory (default: \u002Fvar\u002Flib\u002Fdocker\u002F)\nDOCKER_ROOT=\"\u002Fmnt\u002Fevidence\u002Fvar\u002Flib\u002Fdocker\"\n\n# Examine overlay2 filesystem layers\nls -la $DOCKER_ROOT\u002Foverlay2\u002F\n\n# Find the container's merged filesystem\nCONTAINER_HASH=$(docker inspect $CONTAINER_ID --format '{{.GraphDriver.Data.MergedDir}}' 2>\u002Fdev\u002Fnull)\n# Or manually from forensic image:\n# Look in \u002Fvar\u002Flib\u002Fdocker\u002Fcontainers\u002F\u003Ccontainer_id>\u002Fconfig.v2.json\n\n# Analyze container configuration files\ncat $DOCKER_ROOT\u002Fcontainers\u002F$CONTAINER_ID\u002Fconfig.v2.json | python3 -m json.tool \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_config.json\n\n# Check Docker daemon configuration\ncat \u002Fmnt\u002Fevidence\u002Fetc\u002Fdocker\u002Fdaemon.json 2>\u002Fdev\u002Fnull > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fdaemon_config.json\n\n# Examine Docker events log\ncat $DOCKER_ROOT\u002Fcontainers\u002F$CONTAINER_ID\u002F*.log > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_json_logs.txt\n\n# Check for volume mounts (potential host filesystem access)\npython3 \u003C\u003C 'PYEOF'\nimport json\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_inspect.json') as f:\n    data = json.load(f)\n\ninspect = data[0] if isinstance(data, list) else data\n\nprint(\"=== CONTAINER SECURITY ANALYSIS ===\\n\")\n\n# Check mounts\nprint(\"Volume Mounts:\")\nfor mount in inspect.get('Mounts', []):\n    rw = \"READ-WRITE\" if mount.get('RW') else \"READ-ONLY\"\n    print(f\"  {mount.get('Source', 'N\u002FA')} -> {mount.get('Destination', 'N\u002FA')} ({rw})\")\n    if mount.get('Source') in ('\u002F', '\u002Fetc', '\u002Fvar', '\u002Froot') and mount.get('RW'):\n        print(f\"    WARNING: Sensitive host path mounted read-write!\")\n\n# Check privileged mode\nhost_config = inspect.get('HostConfig', {})\nif host_config.get('Privileged'):\n    print(\"\\nWARNING: Container was running in PRIVILEGED mode!\")\n\n# Check capabilities\ncap_add = host_config.get('CapAdd', [])\nif cap_add:\n    print(f\"\\nAdded Capabilities: {cap_add}\")\n    dangerous_caps = ['SYS_ADMIN', 'SYS_PTRACE', 'NET_ADMIN', 'SYS_MODULE']\n    for cap in cap_add:\n        if cap in dangerous_caps:\n            print(f\"  WARNING: Dangerous capability: {cap}\")\n\n# Check PID namespace\nif host_config.get('PidMode') == 'host':\n    print(\"\\nWARNING: Container shares host PID namespace!\")\n\n# Check network mode\nif host_config.get('NetworkMode') == 'host':\n    print(\"\\nWARNING: Container shares host network namespace!\")\n\n# Check user\nuser = inspect.get('Config', {}).get('User', 'root (default)')\nprint(f\"\\nRunning as user: {user}\")\n\n# Check environment variables for secrets\nenv_vars = inspect.get('Config', {}).get('Env', [])\nprint(f\"\\nEnvironment Variables: {len(env_vars)}\")\nfor env in env_vars:\n    key = env.split('=')[0]\n    if any(s in key.upper() for s in ['PASSWORD', 'SECRET', 'KEY', 'TOKEN', 'CREDENTIAL']):\n        print(f\"  SENSITIVE: {key}=***REDACTED***\")\nPYEOF\n```\n\n### Step 4: Analyze Container File System Changes\n\n```bash\n# Compare container filesystem to original image\ndocker diff $CONTAINER_ID > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Ffilesystem_changes.txt\n\n# A = Added, C = Changed, D = Deleted\n# Analyze changes\npython3 \u003C\u003C 'PYEOF'\nadded = []\nchanged = []\ndeleted = []\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Ffilesystem_changes.txt') as f:\n    for line in f:\n        line = line.strip()\n        if line.startswith('A '):\n            added.append(line[2:])\n        elif line.startswith('C '):\n            changed.append(line[2:])\n        elif line.startswith('D '):\n            deleted.append(line[2:])\n\nprint(f\"Files Added: {len(added)}\")\nprint(f\"Files Changed: {len(changed)}\")\nprint(f\"Files Deleted: {len(deleted)}\")\n\n# Flag suspicious additions\nsuspicious = [f for f in added if any(s in f for s in\n    ['\u002Ftmp\u002F', '\u002Fdev\u002Fshm\u002F', '\u002Froot\u002F', '.sh', '.py', '.elf', 'reverse', 'shell', 'backdoor'])]\nif suspicious:\n    print(f\"\\nSuspicious Added Files:\")\n    for f in suspicious:\n        print(f\"  {f}\")\n\n# Flag suspicious changes\nsus_changed = [f for f in changed if any(s in f for s in\n    ['\u002Fetc\u002Fpasswd', '\u002Fetc\u002Fshadow', '\u002Fetc\u002Fcrontab', '\u002Fetc\u002Fssh', '.bashrc'])]\nif sus_changed:\n    print(f\"\\nSuspicious Changed Files:\")\n    for f in sus_changed:\n        print(f\"  {f}\")\nPYEOF\n\n# Extract and examine the container export\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_fs\u002F\ntar -xf \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_export.tar -C \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_fs\u002F\n\n# Scan for webshells and malicious files\nfind \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_fs\u002Ftmp\u002F -type f -exec file {} \\;\nfind \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_fs\u002F -name \"*.php\" -newer \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_fs\u002Fetc\u002Fhostname\n```\n\n### Step 5: Scan for Vulnerabilities and Generate Report\n\n```bash\n# Scan the image for known vulnerabilities\ntrivy image forensic-evidence:case-2024-001 \\\n   --format json \\\n   --output \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fvulnerability_scan.json\n\n# Scan the exported filesystem\ntrivy fs \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_fs\u002F \\\n   --format table \\\n   --output \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Ffs_vulnerabilities.txt\n\n# Check for secrets in the image\ntrivy image forensic-evidence:case-2024-001 \\\n   --scanners secret \\\n   --format json \\\n   --output \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fsecrets_scan.json\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Image layers | Read-only filesystem layers stacked to form the container image |\n| overlay2 | Default Docker storage driver using union filesystem for layers |\n| Container diff | Comparison of runtime filesystem changes against the original image |\n| Privileged mode | Container with full host capabilities (bypasses most isolation) |\n| Docker socket | Unix socket (\u002Fvar\u002Frun\u002Fdocker.sock) controlling the Docker daemon |\n| Container escape | Technique for breaking out of container isolation to the host |\n| Volume mounts | Host filesystem paths made accessible inside the container |\n| Image history | Record of Dockerfile instructions used to build each layer |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| docker inspect | Detailed container configuration and state information |\n| docker diff | Show filesystem changes made in a running\u002Fstopped container |\n| dive | Interactive Docker image layer analysis tool |\n| container-diff | Google tool for comparing container image contents |\n| Trivy | Vulnerability scanner for container images and filesystems |\n| docker-explorer | Forensic tool for offline Docker artifact analysis |\n| Sysdig | Container runtime security monitoring and forensics |\n| Falco | Runtime threat detection for containers and Kubernetes |\n\n## Common Scenarios\n\n**Scenario 1: Web Application Container Compromise**\nExport the container filesystem, identify webshells in web root, analyze access logs for exploitation attempts, check for added files and modified configurations, examine network connections for C2 communication, review container capabilities for escalation paths.\n\n**Scenario 2: Supply Chain Attack via Malicious Image**\nAnalyze image layers with dive to identify which layer added malicious content, compare with the official base image using container-diff, check image history for suspicious RUN commands, scan for embedded backdoors and cryptocurrency miners, trace the image pull from registry logs.\n\n**Scenario 3: Container Escape Investigation**\nCheck if container ran privileged or with dangerous capabilities, examine host filesystem mount points for unauthorized access, review Docker socket mount enabling Docker-in-Docker abuse, analyze host system logs for container escape indicators, check for kernel exploit artifacts.\n\n**Scenario 4: Cryptojacking in Container Environment**\nIdentify high-CPU containers, export and analyze the container image for mining binaries, check for unauthorized images in the registry, review container creation events for rogue deployments, examine network connections for mining pool communications.\n\n## Output Format\n\n```\nDocker Container Forensics Summary:\n  Container: abc123def456 (nginx-app)\n  Image: company\u002Fweb-app:v2.1\n  Status: Running (started 2024-01-10 09:00 UTC)\n  Host: docker-host-01.corp.local\n\n  Security Configuration:\n    Privileged: No\n    Capabilities Added: NET_ADMIN (WARNING)\n    Volume Mounts: \u002Fvar\u002Flog -> \u002Fhost-logs (RW)\n    Network Mode: bridge\n    User: root (WARNING)\n\n  Filesystem Changes:\n    Added: 23 files (5 suspicious)\n    Changed: 12 files (2 suspicious)\n    Deleted: 0 files\n\n  Suspicious Findings:\n    \u002Ftmp\u002Freverse.sh - Reverse shell script (Added)\n    \u002Fvar\u002Fwww\u002Fhtml\u002F.hidden\u002Fshell.php - PHP webshell (Added)\n    \u002Fetc\u002Fcrontab - Modified (persistence cron entry added)\n    \u002Froot\u002F.ssh\u002Fauthorized_keys - Modified (unauthorized key added)\n\n  Vulnerability Scan:\n    Critical: 3 (CVE-2024-xxxx in base image)\n    High: 12\n    Medium: 34\n\n  Evidence: \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002F\n```\n","# Analyzing Docker Container Forensics\n\n## When to Use\n- When investigating a compromised Docker container or container host\n- For analyzing malicious Docker images pulled from registries\n- During incident response involving containerized application breaches\n- When examining container escape attempts or privilege escalation\n- For auditing container configurations and identifying misconfigurations\n\n## Prerequisites\n- Docker CLI access on the forensic workstation\n- Access to the Docker host file system (forensic image or live)\n- Understanding of Docker layered file system (overlay2, aufs)\n- dive, docker-explorer, or container-diff for image analysis\n- Knowledge of Docker daemon configuration and socket security\n- Trivy or Grype for vulnerability scanning of container images\n\n## Workflow\n\n### Step 1: Preserve Container State and Evidence\n\n```bash\n# List all containers (including stopped)\ndocker ps -a --no-trunc > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_list.txt\n\n# Inspect the compromised container\nCONTAINER_ID=\"abc123def456\"\ndocker inspect $CONTAINER_ID > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_inspect.json\n\n# Export container filesystem as tarball (preserves current state)\ndocker export $CONTAINER_ID > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_export.tar\n\n# Create an image from the container's current state\ndocker commit $CONTAINER_ID forensic-evidence:case-2024-001\ndocker save forensic-evidence:case-2024-001 > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_image.tar\n\n# Capture container logs\ndocker logs $CONTAINER_ID --timestamps > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_logs.txt 2>&1\n\n# Capture running processes (if container is still running)\ndocker top $CONTAINER_ID > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_processes.txt\n\n# Capture network connections\ndocker exec $CONTAINER_ID netstat -tlnp 2>\u002Fdev\u002Fnull > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_network.txt\n\n# Copy specific files from the container\ndocker cp $CONTAINER_ID:\u002Fvar\u002Flog\u002F \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_var_log\u002F\ndocker cp $CONTAINER_ID:\u002Ftmp\u002F \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_tmp\u002F\ndocker cp $CONTAINER_ID:\u002Fetc\u002Fpasswd \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_passwd\n\n# Hash all exported evidence\nsha256sum \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002F*.tar > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fevidence_hashes.txt\n```\n\n### Step 2: Analyze Container Image Layers\n\n```bash\n# Install dive for image layer analysis\nwget https:\u002F\u002Fgithub.com\u002Fwagoodman\u002Fdive\u002Freleases\u002Flatest\u002Fdownload\u002Fdive_linux_amd64.deb\nsudo dpkg -i dive_linux_amd64.deb\n\n# Analyze image layers interactively\ndive forensic-evidence:case-2024-001\n\n# Non-interactive layer analysis\ndive forensic-evidence:case-2024-001 --ci --json \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fdive_analysis.json\n\n# Extract and examine individual layers\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Flayers\u002F\ntar -xf \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_image.tar -C \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Flayers\u002F\n\n# List the image manifest and layer order\ncat \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Flayers\u002Fmanifest.json | python3 -m json.tool\n\n# Examine each layer for changes\nfor layer in \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Flayers\u002F*\u002Flayer.tar; do\n    echo \"=== Layer: $(dirname $layer | xargs basename) ===\"\n    tar -tf \"$layer\" | head -20\n    echo \"...\"\ndone\n\n# Use container-diff to compare with original base image\n# Install container-diff\ncurl -LO https:\u002F\u002Fstorage.googleapis.com\u002Fcontainer-diff\u002Flatest\u002Fcontainer-diff-linux-amd64\nchmod +x container-diff-linux-amd64\n\n# Compare committed image with original\n.\u002Fcontainer-diff-linux-amd64 diff daemon:\u002F\u002Fnginx:latest daemon:\u002F\u002Fforensic-evidence:case-2024-001 \\\n   --type=file --type=apt --type=history --json \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_diff.json\n```\n\n### Step 3: Examine Docker Host Artifacts\n\n```bash\n# Docker data directory (default: \u002Fvar\u002Flib\u002Fdocker\u002F)\nDOCKER_ROOT=\"\u002Fmnt\u002Fevidence\u002Fvar\u002Flib\u002Fdocker\"\n\n# Examine overlay2 filesystem layers\nls -la $DOCKER_ROOT\u002Foverlay2\u002F\n\n# Find the container's merged filesystem\nCONTAINER_HASH=$(docker inspect $CONTAINER_ID --format '{{.GraphDriver.Data.MergedDir}}' 2>\u002Fdev\u002Fnull)\n# Or manually from forensic image:\n# Look in \u002Fvar\u002Flib\u002Fdocker\u002Fcontainers\u002F\u003Ccontainer_id>\u002Fconfig.v2.json\n\n# Analyze container configuration files\ncat $DOCKER_ROOT\u002Fcontainers\u002F$CONTAINER_ID\u002Fconfig.v2.json | python3 -m json.tool \\\n   > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_config.json\n\n# Check Docker daemon configuration\ncat \u002Fmnt\u002Fevidence\u002Fetc\u002Fdocker\u002Fdaemon.json 2>\u002Fdev\u002Fnull > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fdaemon_config.json\n\n# Examine Docker events log\ncat $DOCKER_ROOT\u002Fcontainers\u002F$CONTAINER_ID\u002F*.log > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_json_logs.txt\n\n# Check for volume mounts (potential host filesystem access)\npython3 \u003C\u003C 'PYEOF'\nimport json\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_inspect.json') as f:\n    data = json.load(f)\n\ninspect = data[0] if isinstance(data, list) else data\n\nprint(\"=== CONTAINER SECURITY ANALYSIS ===\\n\")\n\n# Check mounts\nprint(\"Volume Mounts:\")\nfor mount in inspect.get('Mounts', []):\n    rw = \"READ-WRITE\" if mount.get('RW') else \"READ-ONLY\"\n    print(f\"  {mount.get('Source', 'N\u002FA')} -> {mount.get('Destination', 'N\u002FA')} ({rw})\")\n    if mount.get('Source') in ('\u002F', '\u002Fetc', '\u002Fvar', '\u002Froot') and mount.get('RW'):\n        print(f\"    WARNING: Sensitive host path mounted read-write!\")\n\n# Check privileged mode\nhost_config = inspect.get('HostConfig', {})\nif host_config.get('Privileged'):\n    print(\"\\nWARNING: Container was running in PRIVILEGED mode!\")\n\n# Check capabilities\ncap_add = host_config.get('CapAdd', [])\nif cap_add:\n    print(f\"\\nAdded Capabilities: {cap_add}\")\n    dangerous_caps = ['SYS_ADMIN', 'SYS_PTRACE', 'NET_ADMIN', 'SYS_MODULE']\n    for cap in cap_add:\n        if cap in dangerous_caps:\n            print(f\"  WARNING: Dangerous capability: {cap}\")\n\n# Check PID namespace\nif host_config.get('PidMode') == 'host':\n    print(\"\\nWARNING: Container shares host PID namespace!\")\n\n# Check network mode\nif host_config.get('NetworkMode') == 'host':\n    print(\"\\nWARNING: Container shares host network namespace!\")\n\n# Check user\nuser = inspect.get('Config', {}).get('User', 'root (default)')\nprint(f\"\\nRunning as user: {user}\")\n\n# Check environment variables for secrets\nenv_vars = inspect.get('Config', {}).get('Env', [])\nprint(f\"\\nEnvironment Variables: {len(env_vars)}\")\nfor env in env_vars:\n    key = env.split('=')[0]\n    if any(s in key.upper() for s in ['PASSWORD', 'SECRET', 'KEY', 'TOKEN', 'CREDENTIAL']):\n        print(f\"  SENSITIVE: {key}=***REDACTED***\")\nPYEOF\n```\n\n### Step 4: Analyze Container File System Changes\n\n```bash\n# Compare container filesystem to original image\ndocker diff $CONTAINER_ID > \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Ffilesystem_changes.txt\n\n# A = Added, C = Changed, D = Deleted\n# Analyze changes\npython3 \u003C\u003C 'PYEOF'\nadded = []\nchanged = []\ndeleted = []\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Ffilesystem_changes.txt') as f:\n    for line in f:\n        line = line.strip()\n        if line.startswith('A '):\n            added.append(line[2:])\n        elif line.startswith('C '):\n            changed.append(line[2:])\n        elif line.startswith('D '):\n            deleted.append(line[2:])\n\nprint(f\"Files Added: {len(added)}\")\nprint(f\"Files Changed: {len(changed)}\")\nprint(f\"Files Deleted: {len(deleted)}\")\n\n# Flag suspicious additions\nsuspicious = [f for f in added if any(s in f for s in\n    ['\u002Ftmp\u002F', '\u002Fdev\u002Fshm\u002F', '\u002Froot\u002F', '.sh', '.py', '.elf', 'reverse', 'shell', 'backdoor'])]\nif suspicious:\n    print(f\"\\nSuspicious Added Files:\")\n    for f in suspicious:\n        print(f\"  {f}\")\n\n# Flag suspicious changes\nsus_changed = [f for f in changed if any(s in f for s in\n    ['\u002Fetc\u002Fpasswd', '\u002Fetc\u002Fshadow', '\u002Fetc\u002Fcrontab', '\u002Fetc\u002Fssh', '.bashrc'])]\nif sus_changed:\n    print(f\"\\nSuspicious Changed Files:\")\n    for f in sus_changed:\n        print(f\"  {f}\")\nPYEOF\n\n# Extract and examine the container export\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_fs\u002F\ntar -xf \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_export.tar -C \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_fs\u002F\n\n# Scan for webshells and malicious files\nfind \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_fs\u002Ftmp\u002F -type f -exec file {} \\;\nfind \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_fs\u002F -name \"*.php\" -newer \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_fs\u002Fetc\u002Fhostname\n```\n\n### Step 5: Scan for Vulnerabilities and Generate Report\n\n```bash\n# Scan the image for known vulnerabilities\ntrivy image forensic-evidence:case-2024-001 \\\n   --format json \\\n   --output \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fvulnerability_scan.json\n\n# Scan the exported filesystem\ntrivy fs \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fcontainer_fs\u002F \\\n   --format table \\\n   --output \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Ffs_vulnerabilities.txt\n\n# Check for secrets in the image\ntrivy image forensic-evidence:case-2024-001 \\\n   --scanners secret \\\n   --format json \\\n   --output \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002Fsecrets_scan.json\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Image layers | Read-only filesystem layers stacked to form the container image |\n| overlay2 | Default Docker storage driver using union filesystem for layers |\n| Container diff | Comparison of runtime filesystem changes against the original image |\n| Privileged mode | Container with full host capabilities (bypasses most isolation) |\n| Docker socket | Unix socket (\u002Fvar\u002Frun\u002Fdocker.sock) controlling the Docker daemon |\n| Container escape | Technique for breaking out of container isolation to the host |\n| Volume mounts | Host filesystem paths made accessible inside the container |\n| Image history | Record of Dockerfile instructions used to build each layer |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| docker inspect | Detailed container configuration and state information |\n| docker diff | Show filesystem changes made in a running\u002Fstopped container |\n| dive | Interactive Docker image layer analysis tool |\n| container-diff | Google tool for comparing container image contents |\n| Trivy | Vulnerability scanner for container images and filesystems |\n| docker-explorer | Forensic tool for offline Docker artifact analysis |\n| Sysdig | Container runtime security monitoring and forensics |\n| Falco | Runtime threat detection for containers and Kubernetes |\n\n## Common Scenarios\n\n**Scenario 1: Web Application Container Compromise**\nExport the container filesystem, identify webshells in web root, analyze access logs for exploitation attempts, check for added files and modified configurations, examine network connections for C2 communication, review container capabilities for escalation paths.\n\n**Scenario 2: Supply Chain Attack via Malicious Image**\nAnalyze image layers with dive to identify which layer added malicious content, compare with the official base image using container-diff, check image history for suspicious RUN commands, scan for embedded backdoors and cryptocurrency miners, trace the image pull from registry logs.\n\n**Scenario 3: Container Escape Investigation**\nCheck if container ran privileged or with dangerous capabilities, examine host filesystem mount points for unauthorized access, review Docker socket mount enabling Docker-in-Docker abuse, analyze host system logs for container escape indicators, check for kernel exploit artifacts.\n\n**Scenario 4: Cryptojacking in Container Environment**\nIdentify high-CPU containers, export and analyze the container image for mining binaries, check for unauthorized images in the registry, review container creation events for rogue deployments, examine network connections for mining pool communications.\n\n## Output Format\n\n```\nDocker Container Forensics Summary:\n  Container: abc123def456 (nginx-app)\n  Image: company\u002Fweb-app:v2.1\n  Status: Running (started 2024-01-10 09:00 UTC)\n  Host: docker-host-01.corp.local\n\n  Security Configuration:\n    Privileged: No\n    Capabilities Added: NET_ADMIN (WARNING)\n    Volume Mounts: \u002Fvar\u002Flog -> \u002Fhost-logs (RW)\n    Network Mode: bridge\n    User: root (WARNING)\n\n  Filesystem Changes:\n    Added: 23 files (5 suspicious)\n    Changed: 12 files (2 suspicious)\n    Deleted: 0 files\n\n  Suspicious Findings:\n    \u002Ftmp\u002Freverse.sh - Reverse shell script (Added)\n    \u002Fvar\u002Fwww\u002Fhtml\u002F.hidden\u002Fshell.php - PHP webshell (Added)\n    \u002Fetc\u002Fcrontab - Modified (persistence cron entry added)\n    \u002Froot\u002F.ssh\u002Fauthorized_keys - Modified (unauthorized key added)\n\n  Vulnerability Scan:\n    Critical: 3 (CVE-2024-xxxx in base image)\n    High: 12\n    Medium: 34\n\n  Evidence: \u002Fcases\u002Fcase-2024-001\u002Fdocker\u002F\n```\n",{"name":5,"tags":24,"author":31,"domain":32,"license":14,"version":33,"nist_csf":34,"subdomain":38,"description":7,"mitre_attack":39},[25,26,27,28,29,30],"forensics","docker","container-forensics","container-security","image-analysis","runtime-investigation","mahipal","cybersecurity","1.0",[35,36,37],"RS.AN-03","DE.AE-02","RS.MA-01","digital-forensics",[40,41,42,43],"T1610","T1611","T1613","T1612","main","1eb986d0b0ecc180291597e08eb5a58288843536","skills\u002Fcurated_premium_skills\u002FAnthropic-Cybersecurity-Skills\u002Fskills\u002Fanalyzing-docker-container-forensics","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv","2026-08-25 13:16:33",{"source":8,"skillName":5,"commands":51,"prompt":61,"zipAvailable":62},[52,55,58],{"tool":53,"command":54},"npx","npx skills add vikasvardhanv\u002Fjerry_skills --skill analyzing-docker-container-forensics",{"tool":56,"command":57},"bunx","bunx skills add vikasvardhanv\u002Fjerry_skills --skill analyzing-docker-container-forensics",{"tool":59,"command":60},"pnpm","pnpm dlx skills add vikasvardhanv\u002Fjerry_skills --skill analyzing-docker-container-forensics","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fcurated_premium_skills\u002FAnthropic-Cybersecurity-Skills\u002Fskills\u002Fanalyzing-docker-container-forensics\u002FSKILL.md",true,[64,68,74],{"path":65,"resourceType":65,"resourceTypeDesc":66,"sizeBytes":67,"sourceHtmlUrl":15},"LICENSE","许可证",11255,{"path":69,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":72,"sourceHtmlUrl":73},"references\u002Fapi-reference.md","REFERENCE","参考文档",2915,"https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fcurated_premium_skills\u002FAnthropic-Cybersecurity-Skills\u002Fskills\u002Fanalyzing-docker-container-forensics\u002Freferences\u002Fapi-reference.md",{"path":75,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":78,"sourceHtmlUrl":79},"scripts\u002Fagent.py","SCRIPT","脚本",8844,"https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fcurated_premium_skills\u002FAnthropic-Cybersecurity-Skills\u002Fskills\u002Fanalyzing-docker-container-forensics\u002Fscripts\u002Fagent.py",[81,89,96,103,110,117],{"skillNo":82,"name":83,"nameZh":6,"description":84,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":85,"licenseFileUrl":6,"sourceHtmlUrl":86,"categories":87,"keywords":88,"publishedAt":19},"01M7BESR1CJ3H5SP9XM8KYJZ9W","syllabus","Generates a curated supplementary reading list from any course syllabus using Consensus academic search. Grill-me intake (syllabus input format + course audience + year range) plus a grouping forcing-options checkpoint before any search runs — so the reading list matches the course's level and recency need. Parses the syllabus to extract topics and learning outcomes, searches Consensus for recent peer-reviewed papers per topic, and produces a professionally formatted .docx with clickable Consensus links, plain-language summaries calibrated to audience level, and Bloom-higher-order discussion questions tied to course learning goals. Use when the user uploads a syllabus, course outline, or curriculum document and wants supplementary readings (e.g., 'create a reading list from this syllabus', 'find recent papers for my course') — even casual mentions with a syllabus attached should trigger this skill.","MIT","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fresearch\u002Fsyllabus\u002Fskills\u002Fsyllabus\u002FSKILL.md",[],[],{"skillNo":90,"name":91,"nameZh":6,"description":92,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":85,"licenseFileUrl":6,"sourceHtmlUrl":93,"categories":94,"keywords":95,"publishedAt":19},"01M7BES1YA6R97W7QPMFFM1PED","pulse","Multi-source recency research skill that takes the pulse of any topic across Reddit, Hacker News, the open web, and optionally X\u002FTwitter within a configurable recent window (default 30 days). Forcing intake clarifies topic specificity, angle (trend\u002Fsentiment\u002Fproblems\u002Fopportunities\u002Fcomparison), time window, and platform scope before searching. Returns a synthesized briefing with citations, engagement metrics, and cross-platform pattern analysis. Use when the user requests multi-source recency intelligence on a topic (e.g., 'pulse on [topic]', 'what's happening with [topic]', 'what are people saying about [topic]', 'current conversation about [topic]', 'take the pulse of [topic]', 'trending: [topic]', 'find me info on [topic]'), and for competitor research, trend discovery, tool comparisons, and audience sentiment analysis.","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fresearch\u002Fpulse\u002Fskills\u002Fpulse\u002FSKILL.md",[],[],{"skillNo":97,"name":98,"nameZh":6,"description":99,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":85,"licenseFileUrl":6,"sourceHtmlUrl":100,"categories":101,"keywords":102,"publishedAt":19},"01M7BERNHYGY035AR00VRT03KE","patent","Patent prior-art and landscape intelligence skill — not generic patent help. Commits to one of five sub-use-cases via forcing intake (novelty search \u002F freedom-to-operate \u002F competitive landscape \u002F acquisition diligence \u002F litigation prior-art) before any search runs. Searches Google Patents, Espacenet, USPTO, and optionally Lens.org for citation-graph signals. Output is an editable Word document (.docx) with verdict, ranked closest art (claim-text extracted), CPC-class-aware landscape, family-resolved hits, geographic coverage, FTO flags where applicable, strategy recommendations, and full audit log. Use when the user asks for patent searching or analysis (e.g., 'prior art search for [invention]', 'freedom to operate analysis for [product]'). Produces search signal, not legal advice — always recommends consulting a patent attorney before filing or licensing decisions. Trademark, copyright, and trade-secret questions are out of scope.","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fresearch\u002Fpatent\u002Fskills\u002Fpatent\u002FSKILL.md",[],[],{"skillNo":104,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":85,"licenseFileUrl":6,"sourceHtmlUrl":107,"categories":108,"keywords":109,"publishedAt":19},"01M7BERCK1EAKTWW7R436WAR0J","notebooklm","Browser automation skill for controlling Google's NotebookLM. Use when the user wants anything done in NotebookLM (e.g., 'open NotebookLM', 'check my [name] notebook', 'ask my notebook about X', 'add [source] to NotebookLM', 'generate a Video Overview from my notebook', 'use NotebookLM Studio'). Handles reading and querying notebooks, adding sources (URLs, text, files, YouTube links, synthesized content), generating Studio outputs (Audio\u002FVideo Overviews, Mind Maps, Reports incl. Briefing Doc\u002FStudy Guide\u002FFAQ, Flashcards, Quiz, slide decks, infographics — discover the exact set from the live Studio panel; the UI evolves fast), and creating new notebooks. Requires browser automation environment — fails gracefully when unavailable.","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fresearch\u002Fnotebooklm\u002Fskills\u002Fnotebooklm\u002FSKILL.md",[],[],{"skillNo":111,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":85,"licenseFileUrl":6,"sourceHtmlUrl":114,"categories":115,"keywords":116,"publishedAt":19},"01M7BEQZAZAQRTXFJRY7RHV3TY","litreview","Academic literature orientation skill that searches papers via free keyless APIs (PubMed E-utilities + OpenAlex) by default — with the Consensus MCP as an optional enhancement lane when connected — builds a strategic search plan using PICO (default) or SPIDER \u002F Decomposition \u002F hybrid as fallbacks, and synthesizes findings into a formatted Word (.docx) research guide. Grill-me intake (research question specificity + framework hint + tentative depth) before the recon search; a second forcing checkpoint after Phase 2 confirms framework + sub-areas + depth before searches consume budget. Configurable depth (5\u002F10\u002F20 queries) controls coverage vs. speed. Output is a 'launching pad' — an orientation guide that lets a researcher dive in confidently, not a finished review. Use when the user starts literature-oriented research (e.g., 'litreview on [topic]', 'literature review on [topic]', 'I'm starting a literature review on X', 'I'm writing a paper on X', 'help me research X', 'I'm doing research on X', 'can you help me research X'). Do NOT use for single one-off paper searches wanting a quick list — that's a plain PubMed\u002FOpenAlex (or Consensus) query.","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fresearch\u002Flitreview\u002Fskills\u002Flitreview\u002FSKILL.md",[],[],{"skillNo":118,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":85,"licenseFileUrl":6,"sourceHtmlUrl":121,"categories":122,"keywords":123,"publishedAt":19},"01M7BEQKJ45K31QK5VRAQSVJCJ","grants","NIH grant research skill for clinical researchers. Grill-me intake (research idea + career stage + preliminary data + environment + submission posture + known institute targets) locks down the funding strategy before any search runs. Runs a 5-facet Consensus positioning analysis (with draft Significance\u002FInnovation language), maps the research to the right NIH institutes and study sections via RePORTER, finds NOSIs and funded overlap, and produces an editable Word document (.docx) with budget\u002Fscope-aware mechanism recommendations, submission timelines, and a mandatory program officer recommendation. Use when the user asks about research funding or makes any grant-related request (e.g., 'grants for [topic]', 'find grants for my research idea', 'what grants match my research', 'help me find NIH funding', 'grant opportunities for my research'). NIH-only scope — non-NIH funders (PCORI, DOD CDMRP, VA, foundations) are out of scope and flagged at intake.","https:\u002F\u002Fgithub.com\u002Fvikasvardhanv\u002Fjerry_skills\u002Fblob\u002Fmain\u002Fskills\u002Fresearch\u002Fgrants\u002Fskills\u002Fgrants\u002FSKILL.md",[],[]]