mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2.8 KiB
2.8 KiB
API Reference: Docker Container Forensics Tools
docker inspect - Container Details
Syntax
docker inspect <container_id>
docker inspect --format '{{.HostConfig.Privileged}}' <container_id>
docker inspect --format '{{json .Mounts}}' <container_id> | jq
docker inspect --format '{{.GraphDriver.Data.MergedDir}}' <container_id>
Key JSON Paths
| Path | Description |
|---|---|
.HostConfig.Privileged |
Privileged mode status |
.HostConfig.CapAdd |
Added capabilities |
.HostConfig.PidMode |
PID namespace mode |
.HostConfig.NetworkMode |
Network namespace mode |
.Mounts |
Volume mount configuration |
.Config.User |
Container user |
.Config.Env |
Environment variables |
.Config.Image |
Source image name |
.State.StartedAt |
Container start time |
docker diff - Filesystem Changes
Syntax
docker diff <container_id>
Output Codes
| Code | Meaning |
|---|---|
A |
File or directory was added |
C |
File or directory was changed |
D |
File or directory was deleted |
docker export - Container Filesystem Export
Syntax
docker export <container_id> > container_fs.tar
docker export <container_id> | gzip > container_fs.tar.gz
docker commit / docker save - Image Preservation
Syntax
docker commit <container_id> forensic-evidence:case001
docker save forensic-evidence:case001 > evidence_image.tar
docker logs - Container Log Retrieval
Syntax
docker logs --timestamps <container_id>
docker logs --since 2024-01-15 <container_id>
docker logs --tail 1000 <container_id>
docker logs -f <container_id> # Follow (live)
dive - Image Layer Analysis
Syntax
dive <image_name> # Interactive mode
dive <image_name> --ci # CI mode (non-interactive)
dive <image_name> --ci --json out.json # JSON output
Output Includes
- Layer-by-layer filesystem changes
- Image efficiency score
- Wasted space analysis
container-diff - Image Comparison
Syntax
container-diff diff daemon://nginx:latest daemon://suspect:latest \
--type=file --type=apt --type=history --json
Diff Types
| Type | Description |
|---|---|
file |
File system differences |
apt |
APT package differences |
pip |
Python package differences |
history |
Docker build history differences |
Trivy - Vulnerability Scanning
Syntax
trivy image <image_name>
trivy image --format json <image_name>
trivy image --scanners vuln,secret <image_name>
trivy fs /path/to/exported/container/
Severity Levels
CRITICAL | HIGH | MEDIUM | LOW | UNKNOWN
docker-explorer - Offline Forensics
Syntax
de.py -r /var/lib/docker list
de.py -r /var/lib/docker mount <container_id> /mnt/forensic
de.py -r /var/lib/docker history <container_id>