How to use the Docker Container Forensics agent skill

What does the skill make the agent do?

Agent skills are folders of instructions and optional scripts that an AI agent loads when a request matches them. This one covers Docker container forensics. The agent follows a workflow taken from the skill's SKILL.md file rather than improvising.

The workflow has four main stages: preserving evidence from the container, analyzing image layers, examining artifacts on the Docker host, and reviewing filesystem changes. Along the way it flags risky container settings such as privileged mode, host networking, dangerous Linux capabilities and sensitive mounts.

• Preserve state: export the container filesystem, save logs and inspect output, and hash the exported files.
• Analyze image layers with tools such as dive and container-diff.
• Check the Docker host data directory and container configuration files.
• Review filesystem changes with docker diff and flag suspicious added files.
• Run a bundled Python helper (scripts/agent.py) that can run Docker commands and report security misconfigurations.

How do you install the skill?

Download the skill ZIP from this page. Then choose one of the following options, depending on whether you want the skill available everywhere or only in one project.

For a personal install, unzip the file into ~/.claude/skills/. For a single project, unzip it into that project's .claude/skills/ folder. In the Claude apps, you can instead upload the ZIP under Settings → Capabilities → Skills.

• Personal: unzip into ~/.claude/skills/
• Project only: unzip into the project's .claude/skills/ folder
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

What do you need before you start?

The skill assumes you already have working Docker access and some forensic background. The source lists these requirements, and the agent cannot provide them for you.

Access to the Docker host filesystem matters most. You can work from a forensic image of the host or from the live host, but the live option carries the risks described in the safety section.

• Docker CLI and access to the Docker daemon
• Python 3
• dive and container-diff for image analysis
• Trivy or Grype for vulnerability scanning (optional)
• Access to the Docker host filesystem, either a forensic image or the live host
• Familiarity with Docker's layered filesystem (overlay2, aufs) and daemon socket security

How do you trigger the skill with a natural request?

You do not need to type a command to use the skill. Describe the situation in plain language and mention containers, Docker or the container ID. The agent should match the request to the skill's description: investigating compromised containers, analyzing images, layers, volumes, logs and runtime artifacts.

Give the agent as much context as you can, such as the container ID, whether it is still running, and where your case folder is. Requests like these fit the skill's use cases in the source.

• "Investigate container abc123def456 on this host. It may have been compromised. Start by preserving its state."
• "Check whether this nginx-based image has any unexpected files compared with the base image."
• "Audit our docker-compose containers for privileged mode, host networking and risky mounts."
• "Analyze the layers of this suspicious image pulled from a registry."

What does an investigation look like in practice?

A typical run starts with evidence collection. The skill's first step saves the container list, the docker inspect output, the filesystem export, the logs and the process list into a case folder, then hashes the exported files with sha256sum. Only after that does it move on to analysis.

Next, the agent checks the image layers and the host data directory. It then reads the container's configuration and runs a security check on the inspect output. The check reports mounts, privileged mode, added capabilities, PID and network namespace sharing, the container user, and environment variable names that look like secrets, with values redacted.

What are the safety limits?

Some commands in the workflow change or interact with a running workload. The source lists docker commit, docker cp and docker exec among them. Do not run the skill against a live production system without a change plan that accounts for these effects.

The skill is a guide, not a certified process. If the investigation may lead to legal action, have a qualified forensic examiner review the method and the chain of custody. The skill also lists network use, and the install steps for dive and container-diff download files from the internet, so review those downloads before running them. Bundled scripts run on your machine, so read scripts/agent.py before you run it.

• Get a change plan approved before running docker commit, docker cp or docker exec on live systems.
• Prefer a forensic image of the host where possible.
• Have a qualified examiner review any investigation that may go to court.