Digital Forensics and Incident Response (DFIR) using Docker Containers
•
3 likes•1,413 views
Digital Forensics & Incident Response is a multidisciplinary profession that focuses on identifying, investigating, and remeidating computer network exploitation. This can take varied forms and involves a wide variety of skills, kinds of attackers, an kinds of targets. This presentation explains how we can implement docker in DFIR practices.
Report
Share
Report
Share
Recommended
Incident response before:after breach
This document discusses incident response procedures before and after a hacking incident. It defines key terms like incident, incident response, and outlines the main steps of incident response including preparation, detection and analysis, containment, eradication, recovery and post-incident activities. Specific topics covered include what to look for to detect incidents, centralizing logs, forensic investigation, and lessons learned.
Docker 101 : Introduction to Docker and Containers
This document provides an introduction to Docker and containers. It discusses why containers are useful for software deployment given changes in the industry. Containers provide lightweight isolation of applications and their dependencies. Docker is a tool that manages containers running on the same operating system kernel. Key Docker components include the client, server, images, and containers. Popular use cases of Docker include Google running over a billion containers per week and Finnish Railways saving 50% of cloud costs with Docker.
Forensically Sound Incident Response in Office 365 - SANS DFIR Summit 2018
Presented at the 2018 SANS DFIR Summit by Devon Ackerman, Associate Managing Director, Cyber Risk
A planned methodology for developing and implementing a forensically sound incident response plan in Microsoft’s Office 365 cloud environment must be thoroughly researched and re-evaluated over time as the system evolves, new features are introduced, and older capabilities are deprecated. Devon Ackerman’s presentation is based on two years’ worth of collection of forensics and incident response data in Microsoft’s Office 365 and Azure environments, combining knowledge from over a hundred Office 365 investigations, primarily centered around Business Email Compromise (BEC) and insider threat cases.
Densely packed into a 35-minute presentation, Devon walks through the numerous forensic, incident response, and evidentiary aspects of Office 365.
More from Devon Ackerman: https://www.kroll.com/en-us/who-we-are/kroll-experts/devon-ackerman
containerd the universal container runtime
containerd is a widely used container runtime that is now a CNCF project. It is designed to be embedded in larger systems rather than used directly by developers. containerd provides core primitives for managing containers on a host, such as container execution, image distribution, and storage. It focuses on simplicity, robustness, and portability. containerd will serve as a core container runtime for the CNCF ecosystem and is being integrated with projects like Kubernetes.
Grafana Mimir and VictoriaMetrics_ Performance Tests.pptx
VictoriaMetrics and Grafana Mimir are time series databases with support of mostly the same protocols and APIs. However, they have different architectures and components, which makes the comparison more complicated. In the talk, we'll go through the details of the benchmark where I compared both solutions. We'll see how VictoriaMetrics and Mimir are dealing with identical workloads and how efficient they’re with using the allocated resources.
The talk will cover design and architectural details, weak and strong points, trade-offs, and maintenance complexity of both solutions.
MW_Arch Fastest_way_to_hunt_on_Windows_v1.01
Want to hunt on Windows systems quickly? Here is an approach.
ATT&CK
LOG-MD
Logging
MalwareArchaeology
Incident Response
Hunting
Super Easy Memory Forensics
FIRSTCON22のワークショップで使用した資料です。
https://www.first.org/conference/2022/program#pSuper-Easy-Memory-Forensics-You-Can-Mount-Memory-Images-and-Analyze-them-with-Explorer-and-Notepad
Docker Containers Deep Dive
This document provides an overview of Docker containers and their benefits. It discusses how containers provide isolation and portability for applications compared to virtual machines. The document outlines the history and growth of container technologies like Docker. It then covers how to build, ship, and run containerized applications on platforms like Docker, OpenShift, and Kubernetes. Use cases discussed include application development, modernization, and cloud migrations.
Recommended
Incident response before:after breach
This document discusses incident response procedures before and after a hacking incident. It defines key terms like incident, incident response, and outlines the main steps of incident response including preparation, detection and analysis, containment, eradication, recovery and post-incident activities. Specific topics covered include what to look for to detect incidents, centralizing logs, forensic investigation, and lessons learned.
Docker 101 : Introduction to Docker and Containers
This document provides an introduction to Docker and containers. It discusses why containers are useful for software deployment given changes in the industry. Containers provide lightweight isolation of applications and their dependencies. Docker is a tool that manages containers running on the same operating system kernel. Key Docker components include the client, server, images, and containers. Popular use cases of Docker include Google running over a billion containers per week and Finnish Railways saving 50% of cloud costs with Docker.
Forensically Sound Incident Response in Office 365 - SANS DFIR Summit 2018
Presented at the 2018 SANS DFIR Summit by Devon Ackerman, Associate Managing Director, Cyber Risk
A planned methodology for developing and implementing a forensically sound incident response plan in Microsoft’s Office 365 cloud environment must be thoroughly researched and re-evaluated over time as the system evolves, new features are introduced, and older capabilities are deprecated. Devon Ackerman’s presentation is based on two years’ worth of collection of forensics and incident response data in Microsoft’s Office 365 and Azure environments, combining knowledge from over a hundred Office 365 investigations, primarily centered around Business Email Compromise (BEC) and insider threat cases.
Densely packed into a 35-minute presentation, Devon walks through the numerous forensic, incident response, and evidentiary aspects of Office 365.
More from Devon Ackerman: https://www.kroll.com/en-us/who-we-are/kroll-experts/devon-ackerman
containerd the universal container runtime
containerd is a widely used container runtime that is now a CNCF project. It is designed to be embedded in larger systems rather than used directly by developers. containerd provides core primitives for managing containers on a host, such as container execution, image distribution, and storage. It focuses on simplicity, robustness, and portability. containerd will serve as a core container runtime for the CNCF ecosystem and is being integrated with projects like Kubernetes.
Grafana Mimir and VictoriaMetrics_ Performance Tests.pptx
VictoriaMetrics and Grafana Mimir are time series databases with support of mostly the same protocols and APIs. However, they have different architectures and components, which makes the comparison more complicated. In the talk, we'll go through the details of the benchmark where I compared both solutions. We'll see how VictoriaMetrics and Mimir are dealing with identical workloads and how efficient they’re with using the allocated resources.
The talk will cover design and architectural details, weak and strong points, trade-offs, and maintenance complexity of both solutions.
MW_Arch Fastest_way_to_hunt_on_Windows_v1.01
Want to hunt on Windows systems quickly? Here is an approach.
ATT&CK
LOG-MD
Logging
MalwareArchaeology
Incident Response
Hunting
Super Easy Memory Forensics
FIRSTCON22のワークショップで使用した資料です。
https://www.first.org/conference/2022/program#pSuper-Easy-Memory-Forensics-You-Can-Mount-Memory-Images-and-Analyze-them-with-Explorer-and-Notepad
Docker Containers Deep Dive
This document provides an overview of Docker containers and their benefits. It discusses how containers provide isolation and portability for applications compared to virtual machines. The document outlines the history and growth of container technologies like Docker. It then covers how to build, ship, and run containerized applications on platforms like Docker, OpenShift, and Kubernetes. Use cases discussed include application development, modernization, and cloud migrations.
Apache ZooKeeper
Slides for presentation on ZooKeeper I gave at Near Infinity (www.nearinfinity.com) 2012 spring conference.
The associated sample code is on GitHub at https://github.com/sleberknight/zookeeper-samples
Docker 101 - Nov 2016
Containers are not virtual machines - they have fundamentally different architectures and benefits. Docker allows users to build, ship, and run applications inside containers. It provides tools and a platform to manage the lifecycle of containerized applications, from development to production. Containers use layers and copy-on-write to provide efficient application isolation and delivery.
Windows Threat Hunting
This document discusses techniques for threat hunting on Windows systems. It covers key areas to focus on during incident triage like processes, network connections, filesystem artifacts and logs. It also describes general hunting scenarios using threat intelligence or without intelligence. Specific techniques and artifacts discussed include the Windows Task Scheduler, ShimCache, AmCache, RecentFileCache, rogue services, timeline analysis using MFT, DLL side loading, DLL injection rootkits, autoruns, and the Wdigest credential storage downgrade attack. The document provides details on what to look for and analyze to effectively hunt for threats on Windows.
Fortify - Source Code Analyzer
The document provides an overview of Fortify Source Code Analyzer (SCA). It discusses the different analysis phases SCA performs including translation, analysis, and verification. It also describes the various types of analyzers that SCA uses like data flow, control flow, semantic, and structural analyzers. Finally, it outlines the typical commands used to clean, translate, and scan source code with SCA and run an analysis.
Introduction to Docker
Docker is a tool that allows applications to run in isolated containers to make them portable and consistent across environments. It provides benefits like easy developer onboarding, eliminating application conflicts, and consistent deployments. Docker tools include the Docker Engine, Docker Client, Docker Compose, and Docker Hub. Key concepts are images which are templates for containers, and containers which are where the code runs based on an image. The document outlines how to build custom images from Dockerfiles, communicate between containers using linking or networks, and deploy containers using Docker Compose or in the cloud.
Block Storage For VMs With Ceph
Ceph is an open-source distributed storage system that provides object storage, block storage, and file storage functionality. It uses a technique called CRUSH to automatically distribute data across clusters of commodity servers and provide fault tolerance. Ceph block storage (RBD) can be used as reliable virtual disk images for virtual machines and containers, enabling features like live migration. RBD integration is currently being improved for better performance and compatibility with virtualization platforms like Xen and OpenStack.
[cb22] Hayabusa Threat Hunting and Fast Forensics in Windows environments fo...
It started with computer hacking and Japanese linguistics as a kid. Zach Mathis has been based in Kobe, Japan, and has performed both red team services as well as blue team incident response and defense consultation for major Japanese global Japanese corporations since 2006. He is the founder of Yamato Security, one of the largest and most popular hands-on security communities in Japan, and has been providing free training since 2012 to help improve the local security community. Since 2016, he has been teaching security for the SANS institute and holds numerous GIAC certifications. Currently, he is working with other Yamato security members to provide free and open-source security tools to help security analysts with their work.
Secrets of Performance Tuning Java on Kubernetes
Java on Kubernetes may seem complicated, but after a bit of YAML and Dockerfiles, you will wonder what all that fuss was. But then the performance of your app in 1 CPU/1 GB of RAM makes you wonder. Learn how JVM ergonomics, CPU throttling, and GCs can help increase performance while reducing costs.
Spark Shuffle Deep Dive (Explained In Depth) - How Shuffle Works in Spark
The slides explain how shuffle works in Spark and help people understand more details about Spark internal. It shows how the major classes are implemented, including: ShuffleManager (SortShuffleManager), ShuffleWriter (SortShuffleWriter, BypassMergeSortShuffleWriter, UnsafeShuffleWriter), ShuffleReader (BlockStoreShuffleReader).
Introduction to memcached
Introduction to memcached, a caching service designed for optimizing performance and scaling in the web stack, seen from perspective of MySQL/PHP users. Given for 2nd year students of professional bachelor in ICT at Kaho St. Lieven, Gent.
Introduction to container based virtualization with docker
This document provides an overview of Docker and the author's experience. It discusses key Docker concepts like images, containers, the Dockerfile and Docker Engine. It also summarizes Docker benefits like portability, scalability and efficiency. Components like Docker Hub, Docker Machine and orchestration tools are briefly introduced. Security considerations and using Docker in production are also mentioned.
Basic Dynamic Analysis of Malware
This document provides an overview of basic dynamic malware analysis techniques. It explains that dynamic analysis examines how malware behaves when executed by monitoring changes to the system, unusual processes, network traffic, and other behaviors. A number of tools are described that can be used for dynamic analysis, including sandboxes, process monitors, registry snapshots, network service emulators, and packet sniffers. Caution is advised to perform analysis safely in a isolated lab environment.
Docker internals
This document discusses Docker internals and components. It covers:
1. Docker provides build once, configure once capabilities to deploy applications everywhere reliably, consistently, efficiently and cheaply.
2. Docker components include the Docker daemon, libcontainer, cgroups, namespaces, AUFS/BTRFS/dm-thinp, and the kernel-userspace interface.
3. Docker uses filesystem isolation through layering, copy-on-write, caching and differencing using union filesystems like AUFS to provide efficient sharing of files between containers.
Rootless Containers
In this talk we will discuss how to build and run containers without root privileges. As part of the discussion, we will introduce new programs like fuse-overlayfs and slirp4netns and explain how it is possible to do this using user namespaces. fuse-overlayfs allows to use the same storage model as "root" containers and use layered images. slirp4netns emulates a TCP/IP stack in userland and allows to use a network namespace from a container and let it access the outside world (with some limitations).
We will also introduce Usernetes, and how to run Kubernetes in an unprivileged user namespace
https://sched.co/Jcgg
Bypass_AV-EDR.pdf
Comment contourner les mécanismes de sécurité type antivirus et EDR pour exécuter du code ou exfiltrer de la data
Sigma and YARA Rules
Sigma and YARA rules aid Blue Teams in various detections. This presentation will give you a deep understanding on Rule creation and implementation
20230511 - PGConf Nepal - Clustering in PostgreSQL_ Because one database serv...
This document discusses clustering in PostgreSQL to provide high availability and redundancy. It begins by defining high availability and different "nines of availability". It notes that cloud databases like Amazon RDS only provide three and a half nines of availability, leaving room for hours of downtime per year. The document then discusses different clustering architectures like primary-standby replication, active-active multi-node clusters, and globally distributed clusters. It also covers challenges like split-brain situations, network latency, false alarms, and data inconsistency. Finally, it recommends open-source tools like repmgr, pgpool-II and Patroni that can help implement PostgreSQL clustering.
No Easy Breach DerbyCon 2016
Every IR presents unique challenges. But - when an attacker uses PowerShell, WMI, Kerberos attacks, novel persistence mechanisms, seemingly unlimited C2 infrastructure and half-a-dozen rapidly-evolving malware families across a 100k node network to compromise the environment at a rate of 10 systems per day - the cumulative challenges can become overwhelming. This talk will showcase the obstacles overcome during one of the largest and most advanced breaches Mandiant has ever responded to, the novel investigative techniques employed, and the lessons learned that allowed us to help remediate it.
Details a massive intrusion by Russian APT29 (AKA CozyDuke, Cozy Bear)
Container security
This document discusses container security. It outlines the advantages and disadvantages of containers, including their small footprint, fast provisioning time, and ability to enable effective microservices. However, containers also pose security risks like reduced isolation and potential for cross-container attacks. The document then examines different approaches to container security, including host-based methods using namespaces, control groups, and Linux Security Modules, as well as container-based scanning and third-party security offerings. It provides examples of configuring security controls and evaluating containers for vulnerabilities.
Ceph on Windows
Ceph, an open source distributed storage system, has been ported to run natively on Windows Server to provide improved performance over the iSCSI gateway and better integration into the Windows ecosystem. Key components like librbd and librados have been ported to Windows and a new WNBD kernel driver implements fast communication with Linux-based Ceph OSDs. This allows access to RBD block devices and CephFS file systems from Windows with comparable performance to Linux.
Dockerize the World - presentation from Hradec Kralove
This document provides an introduction and overview of Docker delivered in a presentation format. It includes:
1. An agenda that covers Docker introduction, demos, Docker in the cloud, IoT and Docker, and news from DockerCon conferences.
2. Background on the presenter and a poll asking who knows and uses Docker in production.
3. Explanations of what Docker is, how it works using Linux kernel features, and its motto of Build, Ship, Run.
4. Mention of links to the presenter's Docker demos and an open source project called Yowie.
Docker puebla bday #4 celebration
This document summarizes a Docker meetup event in Puebla, Mexico celebrating the 4th anniversary of Docker. The meetup included talks about Docker platform and hands-on labs. Ramon Morales gave a presentation about Docker and its components including images, containers, registries, and Docker Engine. He explained how Docker works and potential use cases. The event aimed to educate the local developer community about Docker and encourage participation in the global Docker community.
More Related Content
What's hot
Apache ZooKeeper
Slides for presentation on ZooKeeper I gave at Near Infinity (www.nearinfinity.com) 2012 spring conference.
The associated sample code is on GitHub at https://github.com/sleberknight/zookeeper-samples
Docker 101 - Nov 2016
Containers are not virtual machines - they have fundamentally different architectures and benefits. Docker allows users to build, ship, and run applications inside containers. It provides tools and a platform to manage the lifecycle of containerized applications, from development to production. Containers use layers and copy-on-write to provide efficient application isolation and delivery.
Windows Threat Hunting
This document discusses techniques for threat hunting on Windows systems. It covers key areas to focus on during incident triage like processes, network connections, filesystem artifacts and logs. It also describes general hunting scenarios using threat intelligence or without intelligence. Specific techniques and artifacts discussed include the Windows Task Scheduler, ShimCache, AmCache, RecentFileCache, rogue services, timeline analysis using MFT, DLL side loading, DLL injection rootkits, autoruns, and the Wdigest credential storage downgrade attack. The document provides details on what to look for and analyze to effectively hunt for threats on Windows.
Fortify - Source Code Analyzer
The document provides an overview of Fortify Source Code Analyzer (SCA). It discusses the different analysis phases SCA performs including translation, analysis, and verification. It also describes the various types of analyzers that SCA uses like data flow, control flow, semantic, and structural analyzers. Finally, it outlines the typical commands used to clean, translate, and scan source code with SCA and run an analysis.
Introduction to Docker
Docker is a tool that allows applications to run in isolated containers to make them portable and consistent across environments. It provides benefits like easy developer onboarding, eliminating application conflicts, and consistent deployments. Docker tools include the Docker Engine, Docker Client, Docker Compose, and Docker Hub. Key concepts are images which are templates for containers, and containers which are where the code runs based on an image. The document outlines how to build custom images from Dockerfiles, communicate between containers using linking or networks, and deploy containers using Docker Compose or in the cloud.
Block Storage For VMs With Ceph
Ceph is an open-source distributed storage system that provides object storage, block storage, and file storage functionality. It uses a technique called CRUSH to automatically distribute data across clusters of commodity servers and provide fault tolerance. Ceph block storage (RBD) can be used as reliable virtual disk images for virtual machines and containers, enabling features like live migration. RBD integration is currently being improved for better performance and compatibility with virtualization platforms like Xen and OpenStack.
[cb22] Hayabusa Threat Hunting and Fast Forensics in Windows environments fo...
It started with computer hacking and Japanese linguistics as a kid. Zach Mathis has been based in Kobe, Japan, and has performed both red team services as well as blue team incident response and defense consultation for major Japanese global Japanese corporations since 2006. He is the founder of Yamato Security, one of the largest and most popular hands-on security communities in Japan, and has been providing free training since 2012 to help improve the local security community. Since 2016, he has been teaching security for the SANS institute and holds numerous GIAC certifications. Currently, he is working with other Yamato security members to provide free and open-source security tools to help security analysts with their work.
Secrets of Performance Tuning Java on Kubernetes
Java on Kubernetes may seem complicated, but after a bit of YAML and Dockerfiles, you will wonder what all that fuss was. But then the performance of your app in 1 CPU/1 GB of RAM makes you wonder. Learn how JVM ergonomics, CPU throttling, and GCs can help increase performance while reducing costs.
Spark Shuffle Deep Dive (Explained In Depth) - How Shuffle Works in Spark
The slides explain how shuffle works in Spark and help people understand more details about Spark internal. It shows how the major classes are implemented, including: ShuffleManager (SortShuffleManager), ShuffleWriter (SortShuffleWriter, BypassMergeSortShuffleWriter, UnsafeShuffleWriter), ShuffleReader (BlockStoreShuffleReader).
Introduction to memcached
Introduction to memcached, a caching service designed for optimizing performance and scaling in the web stack, seen from perspective of MySQL/PHP users. Given for 2nd year students of professional bachelor in ICT at Kaho St. Lieven, Gent.
Introduction to container based virtualization with docker
This document provides an overview of Docker and the author's experience. It discusses key Docker concepts like images, containers, the Dockerfile and Docker Engine. It also summarizes Docker benefits like portability, scalability and efficiency. Components like Docker Hub, Docker Machine and orchestration tools are briefly introduced. Security considerations and using Docker in production are also mentioned.
Basic Dynamic Analysis of Malware
This document provides an overview of basic dynamic malware analysis techniques. It explains that dynamic analysis examines how malware behaves when executed by monitoring changes to the system, unusual processes, network traffic, and other behaviors. A number of tools are described that can be used for dynamic analysis, including sandboxes, process monitors, registry snapshots, network service emulators, and packet sniffers. Caution is advised to perform analysis safely in a isolated lab environment.
Docker internals
This document discusses Docker internals and components. It covers:
1. Docker provides build once, configure once capabilities to deploy applications everywhere reliably, consistently, efficiently and cheaply.
2. Docker components include the Docker daemon, libcontainer, cgroups, namespaces, AUFS/BTRFS/dm-thinp, and the kernel-userspace interface.
3. Docker uses filesystem isolation through layering, copy-on-write, caching and differencing using union filesystems like AUFS to provide efficient sharing of files between containers.
Rootless Containers
In this talk we will discuss how to build and run containers without root privileges. As part of the discussion, we will introduce new programs like fuse-overlayfs and slirp4netns and explain how it is possible to do this using user namespaces. fuse-overlayfs allows to use the same storage model as "root" containers and use layered images. slirp4netns emulates a TCP/IP stack in userland and allows to use a network namespace from a container and let it access the outside world (with some limitations).
We will also introduce Usernetes, and how to run Kubernetes in an unprivileged user namespace
https://sched.co/Jcgg
Bypass_AV-EDR.pdf
Comment contourner les mécanismes de sécurité type antivirus et EDR pour exécuter du code ou exfiltrer de la data
Sigma and YARA Rules
Sigma and YARA rules aid Blue Teams in various detections. This presentation will give you a deep understanding on Rule creation and implementation
20230511 - PGConf Nepal - Clustering in PostgreSQL_ Because one database serv...
This document discusses clustering in PostgreSQL to provide high availability and redundancy. It begins by defining high availability and different "nines of availability". It notes that cloud databases like Amazon RDS only provide three and a half nines of availability, leaving room for hours of downtime per year. The document then discusses different clustering architectures like primary-standby replication, active-active multi-node clusters, and globally distributed clusters. It also covers challenges like split-brain situations, network latency, false alarms, and data inconsistency. Finally, it recommends open-source tools like repmgr, pgpool-II and Patroni that can help implement PostgreSQL clustering.
No Easy Breach DerbyCon 2016
Every IR presents unique challenges. But - when an attacker uses PowerShell, WMI, Kerberos attacks, novel persistence mechanisms, seemingly unlimited C2 infrastructure and half-a-dozen rapidly-evolving malware families across a 100k node network to compromise the environment at a rate of 10 systems per day - the cumulative challenges can become overwhelming. This talk will showcase the obstacles overcome during one of the largest and most advanced breaches Mandiant has ever responded to, the novel investigative techniques employed, and the lessons learned that allowed us to help remediate it.
Details a massive intrusion by Russian APT29 (AKA CozyDuke, Cozy Bear)
Container security
This document discusses container security. It outlines the advantages and disadvantages of containers, including their small footprint, fast provisioning time, and ability to enable effective microservices. However, containers also pose security risks like reduced isolation and potential for cross-container attacks. The document then examines different approaches to container security, including host-based methods using namespaces, control groups, and Linux Security Modules, as well as container-based scanning and third-party security offerings. It provides examples of configuring security controls and evaluating containers for vulnerabilities.
Ceph on Windows
Ceph, an open source distributed storage system, has been ported to run natively on Windows Server to provide improved performance over the iSCSI gateway and better integration into the Windows ecosystem. Key components like librbd and librados have been ported to Windows and a new WNBD kernel driver implements fast communication with Linux-based Ceph OSDs. This allows access to RBD block devices and CephFS file systems from Windows with comparable performance to Linux.
What's hot (20)
[cb22] Hayabusa Threat Hunting and Fast Forensics in Windows environments fo...
[cb22] Hayabusa Threat Hunting and Fast Forensics in Windows environments fo...
Spark Shuffle Deep Dive (Explained In Depth) - How Shuffle Works in Spark
Spark Shuffle Deep Dive (Explained In Depth) - How Shuffle Works in Spark
Introduction to container based virtualization with docker
Introduction to container based virtualization with docker
20230511 - PGConf Nepal - Clustering in PostgreSQL_ Because one database serv...
20230511 - PGConf Nepal - Clustering in PostgreSQL_ Because one database serv...
Similar to Digital Forensics and Incident Response (DFIR) using Docker Containers
Dockerize the World - presentation from Hradec Kralove
This document provides an introduction and overview of Docker delivered in a presentation format. It includes:
1. An agenda that covers Docker introduction, demos, Docker in the cloud, IoT and Docker, and news from DockerCon conferences.
2. Background on the presenter and a poll asking who knows and uses Docker in production.
3. Explanations of what Docker is, how it works using Linux kernel features, and its motto of Build, Ship, Run.
4. Mention of links to the presenter's Docker demos and an open source project called Yowie.
Docker puebla bday #4 celebration
This document summarizes a Docker meetup event in Puebla, Mexico celebrating the 4th anniversary of Docker. The meetup included talks about Docker platform and hands-on labs. Ramon Morales gave a presentation about Docker and its components including images, containers, registries, and Docker Engine. He explained how Docker works and potential use cases. The event aimed to educate the local developer community about Docker and encourage participation in the global Docker community.
Docker, how to use it. organize a meeting with IBM products...
The document provides information about Docker and how it can be used with IBM software and products. It discusses what Docker is, its key components like Engine, Machine and Registry. It also summarizes how Docker can be used to package, ship and run applications in lightweight containers across different environments. The document mentions that IBM supports Docker installation for products like DB2, Websphere Application Server, and provides Docker images on Docker Hub. It also discusses how Docker can be used with IBM products and services like Bluemix, PureApplication System, and for developing IBM Social software.
DCEU 18: Building Your Development Pipeline
This document discusses building a development pipeline using containers. It outlines using containers for building images, automated testing, security scanning, and deploying to production. Containers make environments consistent and reproducible. The pipeline includes building images, testing, security scanning, and promoting images to production. Methods discussed include using multi-stage builds to optimize images, leveraging Buildkit for faster builds, and parallel testing across containers. Automated tools are available to implement rolling updates and rollbacks during deployments.
Faster and Easier Software Development using Docker Platform
Faster and Easier Software Development using Docker Platform presentation for Workshop with Open Source Community 1/2019 organized by MAMPU Malaysia under project Open Source Development and Capabilities Program (OSDeC) for Public Sector in Malaysia on January 29, 2019 at Port Dickson, Negeri Sembilan, Malaysia.
Dockerize the World
Presentation about docker from Java User Group in Ostrava CZ (23th of November 2015). Presented by Martin Damovsky (@damovsky).
Demos are available at https://github.com/damovsky/jug-ostrava-docker
Docker 101: An Introduction
This document provides an introduction to Docker presented by Tibor Vass, a core maintainer on Docker Engine. It outlines challenges with traditional application deployment and argues that Docker addresses these by providing lightweight containers that package code and dependencies. The key Docker concepts of images, containers, builds and Compose are introduced. Images are read-only templates for containers which sandbox applications. Builds describe how to assemble images with Dockerfiles. Compose allows defining multi-container applications. The document concludes by describing how Docker improves the deployment workflow by allowing testing and deployment of the same images across environments.
Clustering Docker with Docker Swarm on openSUSE
This document discusses clustering Docker containers using Docker Swarm on openSUSE. It introduces Docker and containers, describes Docker Swarm for clustering Docker hosts, and provides steps to install and set up Docker Swarm on openSUSE using Consul for discovery. It also discusses using Shipyard for additional Docker management capabilities and composability.
Introduction to Docker
This document introduces Docker and discusses its benefits. Docker is an open platform that allows developers and administrators to build, ship, share, and run distributed applications. It allows building applications from any programming language or framework. Docker provides portability, automation, standardization, and the ability to rapidly scale applications up or down. It also helps support microservices architectures.
Docker in pratice -chenyifei
Lightweight virtualization uses container technology to isolate processes and their resources through namespaces and cgroups. Docker is a container management system that provides lightweight virtualization. Baidu chose Docker for its BAE platform because containers provide better isolation than sandboxes with fewer restrictions and lower costs. Docker meets BAE's needs but was improved with additional security and resource constraints for its PAAS platform.
Docker workshop
Rafael Dutra gave a workshop on Docker at FOSS Day Lajeado 2018. The workshop covered what Docker is, the differences between containers and virtual machines, why one should use Docker, Docker terminology, images and layers, containers and layers, and the Dockerfile anatomy. Hands-on exercises demonstrated Docker installation, basic usage like running containers, interacting with containers, using Dockerfiles to build images, volumes, and Docker Compose.
Containers without docker | DevNation Tech Talk
This document summarizes a talk about running containers without Docker. It discusses alternatives like Podman and Buildah that can replace Docker functionality. The talk demonstrates installing and using Podman to run containers, Buildah to build images from Dockerfiles, and Skopeo to copy images between registries. The presentation encourages understanding containers beyond just Docker and knowing other tools in the ecosystem.
Docker Security
Introduction to common docker security issues. Originally presented at Rochester 2600. http://www.rochester2600.com
Docker for the new Era: Introducing Docker,its components and tools
This document provides an overview of Docker, including:
- Docker enables building applications from components and eliminates friction between development, QA and production environments.
- Other container options include LXC, LXD and OpenVZ, but Docker has gained popularity for its ease of use.
- Docker components include images, containers, registries, and more.
- Docker Hub and Quay.io are popular registries for finding and sharing Docker images.
- Docker Swarm and Docker Compose allow orchestrating multiple Docker containers.
DCA. certificate slide Session 1
DCA. certificate slide
Docker Certifications validate technical knowledge with an industry-recognized credential. Our certifications recognize technical skills on the Docker platform.
Q: How do I become Certified?
You must earn a passing score via a proctored exam to earn a Docker Certification. Upon receiving a passing score, you will receive your certification credentials.
While the Docker Certified Associate certification is designed for enterprise practitioners leveraging the Docker Enterprise Edition (EE) platform in production you will find that many of the topics covered in this foundational certification are also applicable to the freely available Docker Community Edition (CE) due to it's similarity to Docker EE Basic Familiarity with Docker CE is certainly a strong asset and would contribute towards an individual's success on the exam. You can find more information about exactly what topics are covered on the exam in the Study Guide.
Docker Mentor Week 2016 - Medan
The document summarizes Docker Mentor Week events which provide free learning opportunities about Docker. Over 100 events were held globally with over 6000 RSVPs and 400 mentors. The agenda included an introduction to Docker, then participants could choose from 5 courses of varying difficulty levels while mentors were available to help. The goals were to have fun learning Docker from introductory to advanced clustering material. Tools mentioned for the courses included Play with Docker, Docker on laptops, and Docker on cloud providers.
Docker introduction
This document provides an introduction to Docker, including what Docker is, why it matters, and how it works. Some key points:
- Docker implements lightweight containers that provide process isolation using features of the Linux kernel like cgroups and namespaces. It allows building and shipping applications without dependency and compatibility issues.
- Docker solves the "N times N" compatibility problem that arises when applications need to run in different environments. Its portable containers and standardized operations help automate development and deployment workflows.
- Containers isolate applications from one another and their dependencies without the overhead of virtual machines. This makes them lightweight and efficient while still providing isolation of applications and flexibility to run anywhere.
Evotalks Docker Presentation
This document provides an introduction to Docker, including:
- A brief history of container technologies leading to the development of Docker in 2013.
- An overview of the Docker ecosystem and how Docker compares to virtual machines.
- Common Docker commands for interacting with the Docker Engine to run, stop, inspect and manage containers.
- How to build Docker images using Dockerfiles to automate the image creation process.
- How Docker Compose can be used to manage multiple containers through a YAML configuration file.
- Some advantages and disadvantages of using Docker for application deployment.
Docker Timisoara: Dockercon19 recap slides, 23 may 2019
DockerCon 2019 took place in San Francisco, from April 29th to May 2nd.
Open Source @ Dockercon Summit took place Thursday, May 2nd.
Dockercon 2019 was a success with 5000+ participants. We are planning a recap Meetup to highlight overall announcements, new features & news from the event:,
- new CLI plugins announcement (docker app, docker buildx, docker pipeline etc);
- features of Docker Enterprise 3.0 ( assemble, template etc)
- takeaways; useful links, demos, tips and tricks and of course all videos from all the sessions
- cool stuff from the Open summit, like the powerful buildkit
- Demo: Multi-arch Docker Builds
Under this Meetup, we'll discuss news / new feature announcements during Dockercon and their implications for the ecosystem and end user. In addition to the DockerCon recap, we'll have the usual opportunities for networking and Q&A. We will look to answer any questions you have about Dockercon at this meetup.
We invite all of our members to come -- whether you're a beginner or an experienced user of containers. Don't forget to RSVP for this event so we can make sure we have plenty of place for everyone. Save the date for Docker Timisoara Meetup on May 23th @ CoWork The Garden!
containers and virtualization tools ( Docker )
This document provides an overview of containers and virtualization tools like Docker. It defines key concepts like virtual machines (VMs), hypervisors, and containers. It explains that VMs emulate real hardware while containers abstract the operating system to increase efficiency. Docker is introduced as an open-source container platform that builds on Linux features for speed and modularity. Instructions are provided on installing Docker and using common Docker commands to build, run, and manage containerized applications.
Similar to Digital Forensics and Incident Response (DFIR) using Docker Containers (20)
Dockerize the World - presentation from Hradec Kralove
Dockerize the World - presentation from Hradec Kralove
Docker, how to use it. organize a meeting with IBM products...
Docker, how to use it. organize a meeting with IBM products...
Faster and Easier Software Development using Docker Platform
Faster and Easier Software Development using Docker Platform
Docker for the new Era: Introducing Docker,its components and tools
Docker for the new Era: Introducing Docker,its components and tools
Docker Timisoara: Dockercon19 recap slides, 23 may 2019
Docker Timisoara: Dockercon19 recap slides, 23 may 2019
Recently uploaded
Essentials of Automations: The Art of Triggers and Actions in FME
In this second installment of our Essentials of Automations webinar series, we’ll explore the landscape of triggers and actions, guiding you through the nuances of authoring and adapting workspaces for seamless automations. Gain an understanding of the full spectrum of triggers and actions available in FME, empowering you to enhance your workspaces for efficient automation.
We’ll kick things off by showcasing the most commonly used event-based triggers, introducing you to various automation workflows like manual triggers, schedules, directory watchers, and more. Plus, see how these elements play out in real scenarios.
Whether you’re tweaking your current setup or building from the ground up, this session will arm you with the tools and insights needed to transform your FME usage into a powerhouse of productivity. Join us to discover effective strategies that simplify complex processes, enhancing your productivity and transforming your data management practices with FME. Let’s turn complexity into clarity and make your workspaces work wonders!
GraphRAG for Life Science to increase LLM accuracy
GraphRAG for life science domain, where you retriever information from biomedical knowledge graphs using LLMs to increase the accuracy and performance of generated answers
Building Production Ready Search Pipelines with Spark and Milvus
Spark is the widely used ETL tool for processing, indexing and ingesting data to serving stack for search. Milvus is the production-ready open-source vector database. In this talk we will show how to use Spark to process unstructured data to extract vector representations, and push the vectors to Milvus vector database for search serving.
HCL Notes and Domino License Cost Reduction in the World of DLAU
Webinar Recording: https://www.panagenda.com/webinars/hcl-notes-and-domino-license-cost-reduction-in-the-world-of-dlau/
The introduction of DLAU and the CCB & CCX licensing model caused quite a stir in the HCL community. As a Notes and Domino customer, you may have faced challenges with unexpected user counts and license costs. You probably have questions on how this new licensing approach works and how to benefit from it. Most importantly, you likely have budget constraints and want to save money where possible. Don’t worry, we can help with all of this!
We’ll show you how to fix common misconfigurations that cause higher-than-expected user counts, and how to identify accounts which you can deactivate to save money. There are also frequent patterns that can cause unnecessary cost, like using a person document instead of a mail-in for shared mailboxes. We’ll provide examples and solutions for those as well. And naturally we’ll explain the new licensing model.
Join HCL Ambassador Marc Thomas in this webinar with a special guest appearance from Franz Walder. It will give you the tools and know-how to stay on top of what is going on with Domino licensing. You will be able lower your cost through an optimized configuration and keep it low going forward.
These topics will be covered
- Reducing license cost by finding and fixing misconfigurations and superfluous accounts
- How do CCB and CCX licenses really work?
- Understanding the DLAU tool and how to best utilize it
- Tips for common problem areas, like team mailboxes, functional/test users, etc
- Practical examples and best practices to implement right away
Climate Impact of Software Testing at Nordic Testing Days
My slides at Nordic Testing Days 6.6.2024
Climate impact / sustainability of software testing discussed on the talk. ICT and testing must carry their part of global responsibility to help with the climat warming. We can minimize the carbon footprint but we can also have a carbon handprint, a positive impact on the climate. Quality characteristics can be added with sustainability, and then measured continuously. Test environments can be used less, and in smaller scale and on demand. Test techniques can be used in optimizing or minimizing number of tests. Test automation can be used to speed up testing.
TrustArc Webinar - 2024 Global Privacy Survey
How does your privacy program stack up against your peers? What challenges are privacy teams tackling and prioritizing in 2024?
In the fifth annual Global Privacy Benchmarks Survey, we asked over 1,800 global privacy professionals and business executives to share their perspectives on the current state of privacy inside and outside of their organizations. This year’s report focused on emerging areas of importance for privacy and compliance professionals, including considerations and implications of Artificial Intelligence (AI) technologies, building brand trust, and different approaches for achieving higher privacy competence scores.
See how organizational priorities and strategic approaches to data security and privacy are evolving around the globe.
This webinar will review:
- The top 10 privacy insights from the fifth annual Global Privacy Benchmarks Survey
- The top challenges for privacy leaders, practitioners, and organizations in 2024
- Key themes to consider in developing and maintaining your privacy program
20240605 QFM017 Machine Intelligence Reading List May 2024
Everything I found interesting about machines behaving intelligently during May 2024
Let's Integrate MuleSoft RPA, COMPOSER, APM with AWS IDP along with Slack
Discover the seamless integration of RPA (Robotic Process Automation), COMPOSER, and APM with AWS IDP enhanced with Slack notifications. Explore how these technologies converge to streamline workflows, optimize performance, and ensure secure access, all while leveraging the power of AWS IDP and real-time communication via Slack notifications.
GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024
Maruthi Prithivirajan, Head of ASEAN & IN Solution Architecture, Neo4j
Get an inside look at the latest Neo4j innovations that enable relationship-driven intelligence at scale. Learn more about the newest cloud integrations and product enhancements that make Neo4j an essential choice for developers building apps with interconnected data and generative AI.
National Security Agency - NSA mobile device best practices
Threats to mobile devices are more prevalent and increasing in scope and complexity. Users of mobile devices desire to take full advantage of the features
available on those devices, but many of the features provide convenience and capability but sacrifice security. This best practices guide outlines steps the users can take to better protect personal devices and information.
20240609 QFM020 Irresponsible AI Reading List May 2024
Everything I found interesting about the irresponsible use of machine intelligence in May 2024
GraphSummit Singapore | Enhancing Changi Airport Group's Passenger Experience...
Dr. Sean Tan, Head of Data Science, Changi Airport Group
Discover how Changi Airport Group (CAG) leverages graph technologies and generative AI to revolutionize their search capabilities. This session delves into the unique search needs of CAG’s diverse passengers and customers, showcasing how graph data structures enhance the accuracy and relevance of AI-generated search results, mitigating the risk of “hallucinations” and improving the overall customer journey.
Communications Mining Series - Zero to Hero - Session 1
This session provides introduction to UiPath Communication Mining, importance and platform overview. You will acquire a good understand of the phases in Communication Mining as we go over the platform with you. Topics covered:
• Communication Mining Overview
• Why is it important?
• How can it help today’s business and the benefits
• Phases in Communication Mining
• Demo on Platform overview
• Q/A
Full-RAG: A modern architecture for hyper-personalization
Mike Del Balso, CEO & Co-Founder at Tecton, presents "Full RAG," a novel approach to AI recommendation systems, aiming to push beyond the limitations of traditional models through a deep integration of contextual insights and real-time data, leveraging the Retrieval-Augmented Generation architecture. This talk will outline Full RAG's potential to significantly enhance personalization, address engineering challenges such as data management and model training, and introduce data enrichment with reranking as a key solution. Attendees will gain crucial insights into the importance of hyperpersonalization in AI, the capabilities of Full RAG for advanced personalization, and strategies for managing complex data integrations for deploying cutting-edge AI solutions.
みなさんこんにちはこれ何文字まで入るの？40文字以下不可とか本当に意味わからないけどこれ限界文字数書いてないからマジでやばい文字数いけるんじゃないの？えこ...
ここ3000字までしか入らないけどタイトルの方がたくさん文字入ると思います。
Recently uploaded (20)
Essentials of Automations: The Art of Triggers and Actions in FME
Essentials of Automations: The Art of Triggers and Actions in FME
GraphRAG for Life Science to increase LLM accuracy
GraphRAG for Life Science to increase LLM accuracy
Building Production Ready Search Pipelines with Spark and Milvus
Building Production Ready Search Pipelines with Spark and Milvus
HCL Notes and Domino License Cost Reduction in the World of DLAU
HCL Notes and Domino License Cost Reduction in the World of DLAU
Climate Impact of Software Testing at Nordic Testing Days
Climate Impact of Software Testing at Nordic Testing Days
20240605 QFM017 Machine Intelligence Reading List May 2024
20240605 QFM017 Machine Intelligence Reading List May 2024
Let's Integrate MuleSoft RPA, COMPOSER, APM with AWS IDP along with Slack
Let's Integrate MuleSoft RPA, COMPOSER, APM with AWS IDP along with Slack
GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024
GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024
National Security Agency - NSA mobile device best practices
National Security Agency - NSA mobile device best practices
20240609 QFM020 Irresponsible AI Reading List May 2024
20240609 QFM020 Irresponsible AI Reading List May 2024
GraphSummit Singapore | Enhancing Changi Airport Group's Passenger Experience...
GraphSummit Singapore | Enhancing Changi Airport Group's Passenger Experience...
Communications Mining Series - Zero to Hero - Session 1
Communications Mining Series - Zero to Hero - Session 1
Full-RAG: A modern architecture for hyper-personalization
Full-RAG: A modern architecture for hyper-personalization
みなさんこんにちはこれ何文字まで入るの？40文字以下不可とか本当に意味わからないけどこれ限界文字数書いてないからマジでやばい文字数いけるんじゃないの？えこ...
みなさんこんにちはこれ何文字まで入るの？40文字以下不可とか本当に意味わからないけどこれ限界文字数書いてないからマジでやばい文字数いけるんじゃないの？えこ...
Digital Forensics and Incident Response (DFIR) using Docker Containers
- 1. DFIR using Docker Containers Incident Management on the go - Deep Shankar Yadav
- 3. #root@charlie~:whoami • DFIR Practitioner • Red Team Penetration Tester • Security Analyst by Day; Ninja by Night • Disaster Recovery Manager at n|u OWASP Delhi
- 4. DISCLAIMERS • Registered brands belong to their respective owners. • The information provided in this presentation is a results of a proper internet search. • No content in this presentation violates any copyright or intellectual property.
- 5. • What I am Gonna do ?
- 6. Agenda • What is DFIR? • What is Docker? • Why use Docker ? • What can be used ? • How to use
- 13. Yes Sweety it’s all about it
- 14. Recipe for Successful DFIR Practices
- 15. What is Docker?
- 16. What is Docker?
- 17. What is Docker?
- 18. VM vs Docker
- 19. Why Docker? • Isolation • Lightweight • Simplicity • Workflow • Community Support
- 20. Docker Community • 1500+ Contributors • 100,000+ Dockerized Applications • 3 to 4 Million Developers using Docker • 300+ Million Downloads • 35,000 Docker related projects • 70% enterprises are using docker
- 22. DOCKER ENGINE • DOCKER DAEMON • DOCKER CLI
- 23. DOCKER DAEMON • Builds Images • Runs and Manages Containers • RESTful API
- 24. Docker CLI
- 25. Docker Hub
- 26. What Applications can be used? All of them (CLI and Web Interfaces)
- 27. What are we going to see today
- 29. How to run images? 1. FIR: docker run -it -p 8000:8000 fir 2. CyberChef: docker run -d -p 2142:80 remnux/cyberchef 3. COMODO: docker run --rm -v !/null:/malware:ro malice/comodo <filename> 4. Malcom: docker run -p 2215:8080 -d --name malcom tomchop/malcom-automatic 5. Evolve: docker run --rm -it -v ~/null:/home/nonroot/memdumps -p 1337:8080 wzod/evolve bash 6. Volatility: docker run --rm -it -v ~/null:/home/nonroot/memdumps remnux/volatility bash 7. Mastiff: docker run --rm -it -v ~/null:/home/nonroot/workdir remnux/mastiff 8. Maltrive: docker run --rm -it -v ~/null:/archive remnux/maltrieve 9. Jsdetox: docker run --rm -p 3000:3000 remnux/jsdetox 10. PEScanner: docker run --rm -it -v ~/null:/home/nonroot/workdir remnux/pescanner bash
- 30. Charlie, You have been awesome; can I make sandwich for you ?
- 32. Need more details? Keep an eye on my blog https://www.deepshankaryadav.net
- 33. Contact Details Twitter @TheDeepSYadav E-mail : - mail@deepshankaryadav.com Web: https://www.deepshankaryadav.com
- 35. References • https://www.docker.com/ • https://www.google.com • https://digital-forensics.sans.org/ • https://remnux.org/docs/containers/malwar e-analysis/