Docker Forensics

Container modification

There are suspicions that some docker container was compromised:

docker ps
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS               NAMES
cc03e43a052a        lamp-wordpress      "./run.sh"          2 minutes ago       Up 2 minutes        80/tcp              wordpress

You can easily find the modifications done to this container respecting to the image with:

docker diff wordpress
C /var
C /var/lib
C /var/lib/mysql
A /var/lib/mysql/ib_logfile0
A /var/lib/mysql/ib_logfile1
A /var/lib/mysql/ibdata1
A /var/lib/mysql/mysql
A /var/lib/mysql/mysql/time_zone_leap_second.MYI
A /var/lib/mysql/mysql/general_log.CSV
...

In the previous command C means Changed and A, Added. If you find that some interesting file like /etc/shadow was modified you can download it from the container to check for malicious activity with:

docker cp wordpress:/etc/shadow .

You can also compare it with the original one running a new container and extracting the file from it:

docker run -d lamp-wordpress
docker cp b5d53e8b468e:/etc/shadow original_shadow #Get the file from the newly created container
diff original_shadow shadow

If you find that some suspicious file was added you can access the container and check it:

docker exec -it wordpress bash

Images modifications

When you are given an exported docker image (probably in .tar format) you can use the following command to extract the modifications:

docker save <image> > image.tar #Export the image to a .tar file
container-diff analyze -t history image.tar

Then, you can decompress the image and access the blobs to search for suspicious files you may have found in the changes history:

tar -xf image.tar

In order to find added/modified files in docker images you can also use the dive utility:

This allow you to navigate through the different blobs of docker images and check which files were modified/added. Red means added and yellow means modified. Use tab to move to the other view and space to to collapse/open folders.

Credentials from memory

Note that when you run a docker container inside a host you can see the processes running on the container from the host just running ps -ef

Therefore (as root) you can dump the memory of the processes from the host and search for credentials just like in the following example.