Docker Forensics Toolkit
Post-mortem analysis of Docker runtime environments from forensic copies of a Docker host's disk. Docker Forensics Toolkit can mount host disk images, list containers/images, show configs and logs, mount container filesystems, and extract metadata for timeline analysis (e.g. with Sleuth Kit's mactime).
Privileged access
What to know
- Access
- No Caddy route in the example
- Login
- Application login
- Shared services
- No shared resources
- Backups
- No persistent backup requirement recorded
- Resource size
- Small
- Lifecycle
- Stable
Ready for the technical setup?
The stack README documents configuration, storage, networking, deployment, verification, upgrades, and troubleshooting.
View technical setup