What problem does it solve? In CTF sandbox challenges, checked-in Docker Compose or Kubernetes manifests often do not match what the live container or pod is actually doing, making it hard to find where secrets are consumed, how sidecars or init containers alter runtime state, or which route resolves to which container. ## Core Features & Use Cases - Live-vs-Static Comparison: Compares compose/kube manifests against running containers, pods, mounted volumes, environment variables, sidecars, init containers, and entrypoints to find runtime deviations. - Mount and Route Tracing: Maps the full chain from host through reverse proxy to container, mounted volume, and the process that actually consumes a secret or rendered config. - Evidence Reporting: Produces one compact evidence chain from manifest intent to live consumer behavior, preserving container IDs, pod names, mount paths, and runtime-only routes. - Use Case: During a CTF sandbox challenge, a flag secret appears mounted in a pod but the manifest does not explain it. Use this Skill to trace which init container wrote it, which process reads it, and which route exposes the resulting behavior. ## Quick Start Ask the assistant to compare the live container runtime against the checked-in manifests and trace where the mounted secret is consumed, after the ctf-sandbox-orchestrator has established sandbox assumptions.
