Криминалистика скомпрометированных Docker-контейнеров

★ 8.4 · security

analyzing-docker-container-forensics is a Claude Code skill that investigates compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and collect evidence. The workflow covers four phases: preserving container state via filesystem export and SHA-256 hashing, layer-by-layer image analysis using dive and container-diff, examination of Docker host artifacts through overlay2 and config.v2.json files, and vulnerability scanning with Trivy or Grype. It checks for privileged mode, insecure volume mounts, added Linux capabilities, and container escape attempts by parsing the full inspect output programmatically. Designed for incident responders who need to investigate containerized application breaches, audit malicious images pulled from registries, or document privilege escalation in a container environment.