Docker & Containers

DevOps, containers, and the software supply chain: images and registries, CI/CD and npm/dependency attacks, container runtime and escape, and Kubernetes. Evidence here is short-lived and often off by default - preserve it before the container is gone.

Cheat sheet by area

Status: Enabled by default Partial / mixed OFF - must enable

Threat matrix

Container and supply-chain behaviours by area, and the log that first reveals them. Cross-check against the ATT&CK Containers matrix.

Incident response plan

1. Preserve volatile state first (order of volatility). Do not kill the container yet - live memory and processes are the first to vanish.
2. Freeze and snapshot. docker pause <id>, then docker checkpoint create (CRIU - captures RAM) or in Kubernetes the kubelet checkpoint API.
3. Capture the evidence set. docker commit (writable layer), docker export (filesystem tar), docker save (image + layers), docker cp for targeted files. Record sha256 of every artifact.
4. Grab metadata. docker inspect, docker diff, docker top, and docker logs before removal.
5. Establish provenance. Registry pull/push logs and docker history - which image, which tag, which layers, and where it came from.
6. Contain. Stop the workload, revoke any credentials it held (cloud metadata, registry, CI tokens), rotate secrets, remove malicious images and pipeline steps, block egress to mining pools / C2.
7. Scope the supply chain. Diff lockfiles, review CI/CD run history and injected steps, and check other repos/images the compromised token could publish to.
8. Harden. Enable K8s audit logs and a runtime sensor, enforce image signing/admission (only signed, scanned images), drop privileged/hostPath/docker.sock.

How to analyse images & containers

Preserve a running container

docker pause <id>                       # freeze processes
docker checkpoint create <id> ck1        # CRIU snapshot incl. RAM (container unaware)
docker commit <id> ir-evidence:case123    # snapshot writable layer to an image
docker export <id> > container.tar        # flattened filesystem tar
docker save  <image> > image.tar          # image WITH all layers + manifest
docker cp <id>:/path ./evidence/          # targeted file extraction
sha256sum *.tar > hashes.txt              # integrity for chain of custody

Inspect an image (static analysis)

docker inspect <image>                    # entrypoint/cmd, env, mounts, user
docker history --no-trunc <image>         # per-layer build commands + baked-in secrets
dive <image>                              # interactive layer-by-layer diff
trivy image --scanners vuln,secret <image> # CVEs + secrets across layers
syft <image> -o json > sbom.json          # SBOM of every package/version
grype sbom:./sbom.json                    # vulns against NVD/GHSA/OSV

Runtime & escape analysis

docker top <id>                           # process list
nsenter -t <pid> -a ; ls /proc/<pid>/     # enter namespaces; cmdline, environ, fd, maps
# Runtime detection: deploy Falco / Tetragon for syscalls (shell-in-container, mount, ptrace, escape)
# Escape red flags: --privileged, hostPath mounts of / /proc /etc, mounted /var/run/docker.sock,
# dangerous caps (CAP_SYS_ADMIN, SYS_MODULE, SYS_PTRACE). K8s audit + admission logs record the pod spec.

On modern Kubernetes the runtime is usually containerd, not the Docker daemon - the docker CLI and json-file paths may not apply. Use the kubelet checkpoint API and Kubernetes API audit logs instead.

Historical incidents & TTPs

npm / JavaScript supply chain

Other package ecosystems & dependency confusion

Containers, Docker & Kubernetes