Docker Container Forensics
Investigates compromised Docker containers: preserves evidence, analyzes image layers and misconfigurations.
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 3 files
What it does
When installed, the agent follows a structured playbook for investigating a Docker container that may have been hacked. It walks through preserving evidence (exporting the container filesystem, saving logs, hashing files), inspecting image layers with tools like dive and container-diff, checking the host's Docker data directory, and flagging risky container settings such as privileged mode, host networking, dangerous Linux capabilities, and sensitive mounts. A bundled Python helper can run Docker commands and report security misconfigurations.
Great for
- Incident responders investigating a suspected container breach
- Security engineers auditing Docker container configurations
- Students learning container forensics methodology
Skip it if
- Production use on live systems without a change plan: the commands include docker commit, docker cp and exec, which alter or interact with running workloads
- Investigations needing legal-grade chain of custody without review by a qualified forensic examiner, since the skill is a guide rather than a certified process
Try asking
- “Investigate container case-2024-001 that shows unexpected outbound connections and preserve its evidence”
- “Check my Docker containers for privileged mode, host network use and dangerous capabilities”
- “Analyze the layers of this suspicious Docker image and compare it against the nginx base image”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.
analyzing-docker-container-forensics.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip analyzing-docker-container-forensics.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip analyzing-docker-container-forensics.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Run it on a forensic copy or isolated analysis workstation, not directly on production hosts, and review each command before execution.
- Check the scripts and command paths match your environment; the examples use hardcoded case directories and an example container ID.
- Expect the agent to download tools such as dive and container-diff from GitHub and Google Storage, so verify those binaries before running them.
What's inside
- references/api-reference.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.