analyzing-docker-container-forensics

What problem does it solve?

Investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and evidence.

Core Features & Use Cases

• Preserve container state and evidence for later analysis and reporting.
• Analyze image layers and container configuration to identify suspicious changes and misconfigurations.
• Scan for known vulnerabilities using tools like Trivy and document findings.
• Generate structured human-readable reports and machine-readable payloads for integration.

Quick Start

Run the forensics agent against a target container by passing its ID to the script.