fox-it/acquire

Acquire Docker container metadata and filesystems

Opened this issue · 0 comments

We recently had a case where relevant logs (and other traces) were stored in Docker volumes. It would be nice to have a way (a {{docker}} plugin?) to acquire the container and image metadata from {{/var/lib/docker}} as well as the overlayfs layers of the actual containers (i.e. not those of the images, since that would be both less interesting as well as a lot of data).