Find evidence of compromise in Docker containers.
What it does
Collects forensic evidence and produces a security assessment of a Docker container, including suspicious files and vulnerabilities.
When to use it
Use for Docker compromise investigations, malicious image analysis, container incident response, escape investigations, or configuration audits.
How to use it
Give it a container identifier; it saves container evidence for forensic investigation.
What you provide
- the container to investigate
Uses
Latest review
What you need · 3
Requires Docker CLI access on the forensic workstation.
Uses Python 3 to format JSON and analyze container configuration and filesystem changes.
Access · 4
This skill
Docker
Write
Creates a forensic Docker image
dive
Execute
Installs dive from its latest release