https://github.com/osquery/osquery logo
#general
Title
# general
z

Zweasta

06/12/2020, 4:22 PM
Given docker container id and the process path, is there a way to find the package information of a process running inside the container without actually opening a shell on the container?
p

packetzero

06/12/2020, 8:08 PM
on linux this is possible.
z

Zweasta

06/12/2020, 9:53 PM
@packetzero did you mean something like this ? ==>
select * from file WHERE path LIKE "/%" AND pid_with_namespace = 14677;
p

packetzero

06/12/2020, 10:06 PM
something like that. the column name might have changed, or may change soon (cpid ?). Need to follow that PR thread or ask @Stefano Bonicatti if you get really stuck
z

Zweasta

06/12/2020, 10:56 PM
@packetzero I was stuck at this, perhaps I will contact @Stefano Bonicatti. Thank you!
3 Views