Docker Container Forensics

Docker Container Forensics is a DevOps skill for Claude Code, published by mukul975 in Anthropic-Cybersecurity-Skills.

27.8K stars3.4K forkson mukul975/Anthropic-Cybersecurity-SkillsAdded 2026/08/14Repository updated 2026/08/08

ai-agentsclaude-codecloud-securitycybersecuritydevsecopsethical-hackingincident-responseinfosecllmmalware-analysismcpmitre-attacknist-csfosintpenetration-testingred-teamsecuritysecurity-automationthreat-huntingthreat-intelligence

Install in seconds

Install Docker Container Forensics

Copy Docker Container Forensics into your Claude Code skills folder. Run the command in your terminal, or review the source on GitHub before installing.

terminal

npx degit https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/analyzing-docker-container-forensics ~/.claude/skills/analyzing-docker-container-forensics

Requires Node.js. Downloads this skill only — not the rest of the repository — into your Claude Code skills folder.

Without Node.js

git clone https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git

Clones the whole repository, then copy the skill’s own directory into your skills folder yourself.

In this catalog

Source file: skills/analyzing-docker-container-forensics/SKILL.md in mukul975/Anthropic-Cybersecurity-Skills
Installs to: ~/.claude/skills/analyzing-docker-container-forensics
Collection: One of 25 skills cataloged from this repository
Category: DevOps — 798 skills

What Docker Container Forensics does

Docker Container Forensics provides a workflow to preserve and analyze compromised Docker containers, including image layer inspection, host artifact examination, and security configuration auditing. Use it during incident response or container security investigations.

Docker Container Forensics is cataloged under DevOps on DirSkills. Docker Container Forensics comes from a repository tagged ai-agents, claude-code, cloud-security, cybersecurity and devsecops.

Documentation

README

Excerpt

Analyzing Docker Container Forensics

When to Use

When investigating a compromised Docker container or container host
For analyzing malicious Docker images pulled from registries
During incident response involving containerized application breaches
When examining container escape attempts or privilege escalation
For auditing container configurations and identifying misconfigurations

Prerequisites

Docker CLI access on the forensic workstation
Access to the Docker host file system (forensic image or live)
Understanding of Docker layered file system (overlay2, aufs)
dive, docker-explorer, or container-diff for image analysis
Knowledge of Docker daemon configuration and socket security
Trivy or Grype for vulnerability scanning of container images

Workflow

This is the opening of the README. Read the full README on GitHub.

Commands Docker Container Forensics provides

Slash commands named in this skill’s SKILL.md, listed in the order they first appear.

/host-logs

Frequently asked about Docker Container Forensics

What else does mukul975 publish alongside Docker Container Forensics?
Docker Container Forensics is one of 25 skills that DirSkills catalogs from mukul975/Anthropic-Cybersecurity-Skills, the repository it ships in. Its siblings there include API Gateway Log Analysis, Abusing DPAPI for Credential Access and Achieving CMMC Level 2 Compliance. Each one is a separate skill with its own page in this directory, installs the same way Docker Container Forensics does, and is maintained by mukul975 in that same repository. The rest of the collection is listed on the mukul975/Anthropic-Cybersecurity-Skills page.
How does Docker Container Forensics compare to other DevOps skills?
Docker Container Forensics ranks #61 by stars among the 798 DevOps skills in this catalog. The most-starred ones next to it are Backend Patterns, API Connector Builder and Migration. DirSkills ranks by the star count of the repository each skill ships in, so that order reflects how popular those repositories are rather than any review of Docker Container Forensics against them. Open each page to compare what they document and how they install.