Investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and evidence.

Analyzing Docker Container Forensics When to Use When investigating a compromised Docker container or container host For analyzing malicious Docker images pulled from registries During incident response involving containerized application breaches When examining container escape attempts or privilege escalation For auditing container configurations and identifying misconfigurations Prerequisites Docker CLI access on the forensic workstation Access to the Docker host file system (forensic image or live) Understanding of Docker layered file system (overlay2, aufs) dive, docker explorer, or container diff for image analysis Knowledge of Docker daemon configuration and socket security Trivy or Grype for vulnerability scanning of container images Workflow Step 1: Preserve Container State and Evidence Step 2: Analyze Container Image Layers Step 3: Examine Docker Host Artifacts Step 4: Analyze Container File System Changes Step 5: Scan for Vulnerabilities and Generate Report Key Concepts Concept Description Image layers Read only filesystem layers stacked to form the container image overlay2 Default Docker storage driver using union filesystem for layers Container diff Comparison of runtime filesystem changes against the original image Privileged mode Container with full host capabilities (bypasses most isolation) Docker socket Unix socket (/var/run/docker.sock) controlling the Docker daemon Container escape Technique for breaking out of container isolation to the host Volume mounts Host filesystem paths made accessible inside the container Image history Record of Dockerfile instructions used to build each layer Tools & Systems Tool Purpose docker inspect Detailed container configuration and state information docker diff Show filesystem changes made in a running/stopped container dive Interactive Docker image layer analysis tool container diff Google tool for comparing container image contents Trivy Vulnerability scanner for container images and filesystems docker explorer Forensic tool for offline Docker artifact analysis Sysdig Container runtime security monitoring and forensics Falco Runtime threat detection for containers and Kubernetes Common Scenarios Scenario 1: Web Application Container Compromise Export the container filesystem, identify webshells in web root, analyze access logs for exploitation attempts, check for added files and modified configurations, examine network connections for C2 communication, review container capabilities for escalation paths. Scenario 2: Supply Chain Attack via Malicious Image Analyze image layers with dive to identify which layer added malicious content, compare with the official base image using container diff, check image history for suspicious RUN commands, scan for embedded backdoors and cryptocurrency miners, trace the image pull from registry logs. Scenario 3: Container Escape Investigation Check if container ran privileged or with dangerous capabilities, examine host filesystem mount points for unauthorized access, review Docker socket mount enabling Docker in Docker abuse, analyze host system logs for container escape indicators, check for kernel exploit artifacts. Scenario 4: Cryptojacking in Container Environment Identify high CPU containers, export and analyze the container image for mining binaries, check for unauthorized images in the registry, review container creation events for rogue deployments, examine network connections for mining pool communications. Output Format

analyzing-docker-container-forensics