Skip to content

Instantly share code, notes, and snippets.

@Saluki

Saluki/container-osquery_root.sql

Created January 28, 2019 10:44
Show Gist options
  • Save Saluki/7715c0c16c67c9ea2c191161d3f118bc to your computer and use it in GitHub Desktop.
Save Saluki/7715c0c16c67c9ea2c191161d3f118bc to your computer and use it in GitHub Desktop.
Download ZIP
MEDIUM - Container OSQuery - Root containers
Raw
container-osquery_root.sql
-- Detect contains with process that run with the root user
SELECT containers.name, processes.pid, processes.name, cmdline, user
FROM docker_container_processes processes
JOIN docker_containers containers ON containers.id=processes.id
WHERE processes.id IN (
SELECT id FROM docker_containers
) AND user="root";
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment