container-forensics

namespace	aiwg
name	container-forensics
description	Docker, containerd/CRI-O, and Kubernetes forensic investigation covering container inventory (docker and crictl), privilege checks, image verification, layer analysis (dive), escape detection, eBPF runtime monitoring (Falco, Tetragon, Tracee), K8s RBAC audit, etcd security audit, and API server audit log analysis
tools	Bash, Read, Write, Glob, Grep
platforms	["all"]

container-forensics

Investigates containerized environments for signs of compromise, misconfiguration, or container escape. Covers standalone Docker hosts and Kubernetes clusters. Produces a structured findings document with severity tagging.

Triggers

Alternate expressions and non-obvious activations (primary phrases are matched automatically from the skill description):

• "Falco" / "Tetragon" / "Tracee" → eBPF runtime monitoring tools
• "dive" → Docker image layer analysis
• "crictl" → containerd/CRI-O environment forensics
• "escape" → container escape investigation

Purpose

Container environments introduce unique attack surfaces: privileged containers, host namespace access, writable image layers, and overpermissioned service accounts. Standard host forensics misses these vectors. This skill applies container-aware investigation procedures and maps findings to MITRE ATT&CK for Containers.

Behavior

When triggered, this skill:

1. Detect environment type:

   • Check for Docker: docker info 2>/dev/null
   • Check for Kubernetes: kubectl cluster-info 2>/dev/null or presence of /var/run/secrets/kubernetes.io/
   • Check for containerd-only (no Docker): ctr version 2>/dev/null
   • Check for CRI-O or containerd via CRI: crictl version 2>/dev/null
   • Determine if running inside a container: check for /.dockerenv, inspect cgroup paths

2. Container inventory and privilege audit:

   • List all containers (running and stopped): docker ps -a --format '{{json .}}'
   • For containerd/CRI-O environments: crictl pods and crictl ps -a
   • Inspect individual containers: crictl inspect <id> (equivalent of docker inspect)
   • List images on CRI nodes: crictl images and crictl inspecti <image-id>
   • Pull container logs via CRI: crictl logs <container-id>
   • Flag containers with dangerous flags:
     • --privileged: docker inspect <id> | jq '.[].HostConfig.Privileged'
     • Host network mode: NetworkMode == "host"
     • Host PID namespace: PidMode == "host"
     • Dangerous capability additions: CapAdd containing SYS_ADMIN, NET_ADMIN, SYS_PTRACE
   • Enumerate bind mounts of sensitive host paths (/, /etc, /var/run/docker.sock, /proc, /sys)

3. Docker — image verification:

   • List all local images with digests: docker images --digests
   • Check image provenance: compare RepoDigests against expected registry
   • Flag images tagged latest without a pinned digest
   • Inspect image build history for suspicious RUN layers: docker history --no-trunc <image>

Usage Examples

Example 1 — Docker host

docker investigation

Audits the local Docker daemon.

Example 2 — Kubernetes cluster

kubernetes forensics

Requires kubectl configured with appropriate credentials.

Example 3 — Inside a container

container forensics

Detects the container context and adjusts collection accordingly.

Output Locations

• Findings: .aiwg/forensics/findings/container-forensics.md
• Raw Docker inspection: .aiwg/forensics/evidence/docker-inspect.json
• crictl inspection output: .aiwg/forensics/evidence/crictl-inspect.json
• K8s pod manifest dump: .aiwg/forensics/evidence/k8s-pods.json
• Falco alert log: .aiwg/forensics/evidence/falco-alerts.log
• Tetragon events: .aiwg/forensics/evidence/tetragon-events.json
• Tracee events: .aiwg/forensics/evidence/tracee-events.json
• etcd snapshot: .aiwg/forensics/evidence/etcd-snapshot-<timestamp>.db
• K8s API server audit log (copy): .aiwg/forensics/evidence/k8s-audit.log

Configuration

container_forensics:
  dangerous_capabilities:
    - SYS_ADMIN
    - NET_ADMIN
    - SYS_PTRACE
    - SYS_MODULE
  sensitive_host_paths:
    - /
    - /etc
    - /var/run/docker.sock
    - /proc
    - /sys
    - /root
  high_value_namespaces:
    - kube-system
    - kube-public
    - default

References

• @$AIWG_ROOT/agentic/code/addons/aiwg-utils/rules/research-before-decision.md — Detect environment type (Docker, containerd, Kubernetes) before applying collection procedures
• @$AIWG_ROOT/agentic/code/frameworks/forensics-complete/rules/non-destructive.md — Do not stop or remove containers until all artifacts are collected and hashed
• @$AIWG_ROOT/agentic/code/frameworks/forensics-complete/rules/red-flag-escalation.md — Escalate immediately when container escape, Docker socket exposure, or privileged escape is confirmed
• @$AIWG_ROOT/agentic/code/frameworks/forensics-complete/rules/evidence-integrity.md — Hash container logs and filesystem exports immediately after collection
• @$AIWG_ROOT/agentic/code/frameworks/forensics-complete/skills/linux-forensics/SKILL.md — Investigate the underlying host after container forensics; container escapes leave traces on the host