# Docker Pentesting
Docker is a set of platform as a service products that use OS-level virtualization to deliver software in packages called containers. Default ports are 2375, 2376.
### Investigation
#### Find Docker Binary
If we cannot use `docker` command by default, we need to find the docker binary.
```shellscript
find / -name "docker" 2>/dev/null
```
#### Basic Commands
```shellscript
# Get comprehensive information
docker info
# List images
docker images
docker image ls
# The history of an image
docker image history
# List containers running
docker container ls
# or
docker ps
# List all containers
docker container ls -a
# or
docker ps -a
# List secrets
docker secret ls
# Check configuration of container
docker inspect --format='{{json .Config}}'
# Get a port which is used by the container
docker port
# Scan vulnerabilies (CVEs)
docker scan cves
docker scan cves alpine
# View the SBOM (Software Bill of Materials) for an image
# We can investigate vulnerabilities from the list of packages.
docker sbom alpine:latest
# Json format
docker sbom alpine:latest --format syft-json
# Spawn the shell in the container
docker exec -it /bin/bash
# Kill the running docker container
docker kill
```
#### Check if Containers Running
In target machine, observe the network status by running `netstat` or `ss` command.
```shellscript
netstat -punta
# or
ss -ltu
# -------------------------------------------------------
tcp 0 0 127.0.0.1:2375 0.0.0.0:* LISTEN -
```
### Basic Operations
#### Run a New Container
First check the docker images listed.
```
docker images
```
Then run a new container from the image.
```shellscript
# -d: detached mode (background)
# -p: map the port of the host to the port in the container
docker run -dp 80:80
```
If you want to run a new container from a remote repository, run the following.
```shellscript
# --rm: Removes the anonymous volumes when the container is removed
# -i: interactive
# -t: tty
# --network=host: The container is not isolated from the Docker host. The IP address is your own home IP address.
docker run --rm -it --network=host /
# /bin/bash: spawn a shell within the container
docker run -it nginx /bin/bash
```
#### Start a Container which is stopped
```shellscript
# List all containers and check the target ID
docker container ls -a
# Start the container
docker container start
```
#### Run Commands in a Container
```shellscript
# List containers running and check the target container ID
docker ps
# Run commands by giving the container ID
docker exec whoami
docker exec cat sample.txt
```
#### Stop a Container
```shellscript
# List running containers and check the target container ID
docker ps
# Stop the container by giving the ID
docker stop
```
#### Remove a Container
```shellscript
# List all containers and check the target container ID
docker ps -a
# Remove the container by givine the ID
docker rm
# Force to remove the running container (-f)
docker rm -f
```
#### Build a Container Image
First off, create a **Dockerfile** in the root directory of the project.
```shellscript
FROM node:12-alpine
RUN apk add --no-cache python2 g++ make
WORKDIR /app
COPY . .
RUN yarn install --production
CMD ["node", "src/index.js"]
```
Now run the following command to build the container image.\
This command uses the Dockerfile.
```shellscript
# -t: name a tag of the image
docker build -t .
```
#### Scan a Container Image
```shellscript
docker scan
```
#### Pull a Docker Image
We need to download a docker image to start a container at first.
```shellscript
docker pull
docker pull nginx
# Specify a tag
docker pull :
docker pull nginx:latest
docker pull nginx:stable
```
#### Remove a Docker Image
```shellscript
# List images and check the target image ID
docker images
# Remove the image by giving the ID
docker rmi
```
#### Publish a Docker Image
Before doing below, you need to sign up the Docker Hub and sign in, then create a new repository in your dashboard.
```shellscript
# Login
docker login -u
# Tag a new image
docker tag /
# Push
docker push /
```