mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
117 lines
2.8 KiB
Markdown
117 lines
2.8 KiB
Markdown
# API Reference: Docker Container Forensics Tools
|
|
|
|
## docker inspect - Container Details
|
|
|
|
### Syntax
|
|
```bash
|
|
docker inspect <container_id>
|
|
docker inspect --format '{{.HostConfig.Privileged}}' <container_id>
|
|
docker inspect --format '{{json .Mounts}}' <container_id> | jq
|
|
docker inspect --format '{{.GraphDriver.Data.MergedDir}}' <container_id>
|
|
```
|
|
|
|
### Key JSON Paths
|
|
| Path | Description |
|
|
|------|-------------|
|
|
| `.HostConfig.Privileged` | Privileged mode status |
|
|
| `.HostConfig.CapAdd` | Added capabilities |
|
|
| `.HostConfig.PidMode` | PID namespace mode |
|
|
| `.HostConfig.NetworkMode` | Network namespace mode |
|
|
| `.Mounts` | Volume mount configuration |
|
|
| `.Config.User` | Container user |
|
|
| `.Config.Env` | Environment variables |
|
|
| `.Config.Image` | Source image name |
|
|
| `.State.StartedAt` | Container start time |
|
|
|
|
## docker diff - Filesystem Changes
|
|
|
|
### Syntax
|
|
```bash
|
|
docker diff <container_id>
|
|
```
|
|
|
|
### Output Codes
|
|
| Code | Meaning |
|
|
|------|---------|
|
|
| `A` | File or directory was added |
|
|
| `C` | File or directory was changed |
|
|
| `D` | File or directory was deleted |
|
|
|
|
## docker export - Container Filesystem Export
|
|
|
|
### Syntax
|
|
```bash
|
|
docker export <container_id> > container_fs.tar
|
|
docker export <container_id> | gzip > container_fs.tar.gz
|
|
```
|
|
|
|
## docker commit / docker save - Image Preservation
|
|
|
|
### Syntax
|
|
```bash
|
|
docker commit <container_id> forensic-evidence:case001
|
|
docker save forensic-evidence:case001 > evidence_image.tar
|
|
```
|
|
|
|
## docker logs - Container Log Retrieval
|
|
|
|
### Syntax
|
|
```bash
|
|
docker logs --timestamps <container_id>
|
|
docker logs --since 2024-01-15 <container_id>
|
|
docker logs --tail 1000 <container_id>
|
|
docker logs -f <container_id> # Follow (live)
|
|
```
|
|
|
|
## dive - Image Layer Analysis
|
|
|
|
### Syntax
|
|
```bash
|
|
dive <image_name> # Interactive mode
|
|
dive <image_name> --ci # CI mode (non-interactive)
|
|
dive <image_name> --ci --json out.json # JSON output
|
|
```
|
|
|
|
### Output Includes
|
|
- Layer-by-layer filesystem changes
|
|
- Image efficiency score
|
|
- Wasted space analysis
|
|
|
|
## container-diff - Image Comparison
|
|
|
|
### Syntax
|
|
```bash
|
|
container-diff diff daemon://nginx:latest daemon://suspect:latest \
|
|
--type=file --type=apt --type=history --json
|
|
```
|
|
|
|
### Diff Types
|
|
| Type | Description |
|
|
|------|-------------|
|
|
| `file` | File system differences |
|
|
| `apt` | APT package differences |
|
|
| `pip` | Python package differences |
|
|
| `history` | Docker build history differences |
|
|
|
|
## Trivy - Vulnerability Scanning
|
|
|
|
### Syntax
|
|
```bash
|
|
trivy image <image_name>
|
|
trivy image --format json <image_name>
|
|
trivy image --scanners vuln,secret <image_name>
|
|
trivy fs /path/to/exported/container/
|
|
```
|
|
|
|
### Severity Levels
|
|
`CRITICAL` | `HIGH` | `MEDIUM` | `LOW` | `UNKNOWN`
|
|
|
|
## docker-explorer - Offline Forensics
|
|
|
|
### Syntax
|
|
```bash
|
|
de.py -r /var/lib/docker list
|
|
de.py -r /var/lib/docker mount <container_id> /mnt/forensic
|
|
de.py -r /var/lib/docker history <container_id>
|
|
```
|