Zweasta
07/08/2020, 3:46 PMsudo osqueryi --json 'select * from docker_container_ports'
is not showing any output even though there are docker ports associated with host ports.. Any idea ?CptOfEvilMinions
07/08/2020, 6:04 PMsudo usermod -aG docker $USER
Zweasta
07/08/2020, 6:54 PMsudo usermod -aG docker $USER
but its still not showing any ports..theopolis
07/08/2020, 7:14 PM--verbose
(2) does docker_containers
work?Zweasta
07/08/2020, 7:42 PMtheopolis
07/08/2020, 8:39 PMstrace
and seeing what is going wrong or if this is expected. @Seshu is the original author (may be a good SME) and here's the code implementation https://github.com/osquery/osquery/blob/master/osquery/tables/applications/posix/docker.cppSeshu
07/08/2020, 8:44 PMZweasta
07/08/2020, 8:45 PMDocker version 19.03.5, build 633a0ea
Linux: CentOS
Seshu
07/08/2020, 9:00 PMsudo curl -s --unix-socket /var/run/docker.sock -H 'Content-Type: application/json' <http://localhost/containers/json> | jq ".[] | .Ports"
Zweasta
07/08/2020, 9:07 PM-bash: jq: command not found
(23) Failed writing body
This the the outputSeshu
07/08/2020, 9:09 PMjq
. Or skip the pipe and redirect the output to a file. Look for Ports
in each entryZweasta
07/08/2020, 9:12 PMSeshu
07/08/2020, 9:55 PMdocker ps
Zweasta
07/08/2020, 9:59 PMdocker inspect --format '{{.Config.ExposedPorts}}' container-id
For this command I got output as: map[27017/tcp:{}]
for one of the containers
similarly, I have one port reporting for my other containerSeshu
07/08/2020, 10:31 PMEXPOSE
in your Dockerfile
that should show up in docker_container_ports
in port
column. When the container is run, if the container port is mapped to a host port, then host_ip
and host_port
will be non-empty.Zweasta
07/08/2020, 10:38 PMSeshu
07/09/2020, 1:59 AMEXPOSE
exists in Dockerfile
, you should see a row in docker_container_ports
even if no process is listening on that port
• Whether EXPOSE
exists or not in Dockerfile, if you use -p/--publish
option when running the container, that should show up in docker_container_ports
. In this case host_ip and host_port should not be emptyZweasta
07/09/2020, 12:27 PMSeshu
07/09/2020, 4:23 PMZweasta
07/09/2020, 5:07 PM