container-forensics

namespace	aiwg
name	container-forensics
description	Forensic investigation of Docker, containerd/CRI-O, and Kubernetes — inventory, escape detection, eBPF runtime monitoring, RBAC and etcd audit. Use when investigating container compromise.
tools	Bash, Read, Write, Glob, Grep
platforms	["all"]

container-forensics

Investigates containerized environments for signs of compromise, misconfiguration, or container escape. Covers standalone Docker hosts and Kubernetes clusters. Produces a structured findings document with severity tagging.

Triggers

Alternate expressions and non-obvious activations (primary phrases are matched automatically from the skill description):

• "Falco" / "Tetragon" / "Tracee" → eBPF runtime monitoring tools
• "dive" → Docker image layer analysis
• "crictl" → containerd/CRI-O environment forensics
• "escape" → container escape investigation

Purpose

Container environments introduce unique attack surfaces: privileged containers, host namespace access, writable image layers, and overpermissioned service accounts. Standard host forensics misses these vectors. This skill applies container-aware investigation procedures and maps findings to MITRE ATT&CK for Containers.

Behavior

When triggered, this skill:

1. Detect environment type:

   • Check for Docker: docker info 2>/dev/null
   • Check for Kubernetes: kubectl cluster-info 2>/dev/null or presence of /var/run/secrets/kubernetes.io/
   • Check for containerd-only (no Docker): ctr version 2>/dev/null
   • Check for CRI-O or containerd via CRI: crictl version 2>/dev/null
   • Determine if running inside a container: check for /.dockerenv, inspect cgroup paths

2. Container inventory and privilege audit:

   • List all containers (running and stopped): docker ps -a --format '{{json .}}'
   • For containerd/CRI-O environments: crictl pods and crictl ps -a
   • Inspect individual containers: crictl inspect <id> (equivalent of docker inspect)
   • List images on CRI nodes: crictl images and crictl inspecti <image-id>
   • Pull container logs via CRI: crictl logs <container-id>
   • Flag containers with dangerous flags:
     • --privileged: docker inspect <id> | jq '.[].HostConfig.Privileged'
     • Host network mode: NetworkMode == "host"
     • Host PID namespace: PidMode == "host"
     • Dangerous capability additions: CapAdd containing SYS_ADMIN, NET_ADMIN, SYS_PTRACE
   • Enumerate bind mounts of sensitive host paths (/, /etc, /var/run/docker.sock, /proc, /sys)

3. Docker — image verification:

   • List all local images with digests: docker images --digests
   • Check image provenance: compare RepoDigests against expected registry
   • Flag images tagged latest without a pinned digest
   • Inspect image build history for suspicious RUN layers: docker history --no-trunc <image>

Usage Examples

Example 1 — Docker host

docker investigation

Audits the local Docker daemon.

Example 2 — Kubernetes cluster

kubernetes forensics

Requires kubectl configured with appropriate credentials.

Example 3 — Inside a container

container forensics

Detects the container context and adjusts collection accordingly.

Output Locations

• Findings: .aiwg/forensics/findings/container-forensics.md
• Raw Docker inspection: .aiwg/forensics/evidence/docker-inspect.json
• crictl inspection output: .aiwg/forensics/evidence/crictl-inspect.json
• K8s pod manifest dump: .aiwg/forensics/evidence/k8s-pods.json
• Falco alert log: .aiwg/forensics/evidence/falco-alerts.log
• Tetragon events: .aiwg/forensics/evidence/tetragon-events.json
• Tracee events: .aiwg/forensics/evidence/tracee-events.json
• etcd snapshot: .aiwg/forensics/evidence/etcd-snapshot-<timestamp>.db
• K8s API server audit log (copy): .aiwg/forensics/evidence/k8s-audit.log

Configuration

container_forensics:
  dangerous_capabilities:
    - SYS_ADMIN
    - NET_ADMIN
    - SYS_PTRACE
    - SYS_MODULE
  sensitive_host_paths:
    - /
    - /etc
    - /var/run/docker.sock
    - /proc
    - /sys
    - /root
  high_value_namespaces:
    - kube-system
    - kube-public
    - default

References

• @$AIWG_ROOT/agentic/code/addons/aiwg-utils/rules/research-before-decision.md — Detect environment type (Docker, containerd, Kubernetes) before applying collection procedures
• @$AIWG_ROOT/agentic/code/frameworks/forensics-complete/rules/non-destructive.md — Do not stop or remove containers until all artifacts are collected and hashed
• @$AIWG_ROOT/agentic/code/frameworks/forensics-complete/rules/red-flag-escalation.md — Escalate immediately when container escape, Docker socket exposure, or privileged escape is confirmed
• @$AIWG_ROOT/agentic/code/frameworks/forensics-complete/rules/evidence-integrity.md — Hash container logs and filesystem exports immediately after collection
• @$AIWG_ROOT/agentic/code/frameworks/forensics-complete/skills/linux-forensics/SKILL.md — Investigate the underlying host after container forensics; container escapes leave traces on the host