Docker

​

Overview

​

Tools Available

​

Configuration

​

Local Docker Socket

{
  "tools": {
    "docker": {
      "enabled": true,
      "socket": "/var/run/docker.sock"
    }
  }
}

​

Remote Docker API

{
  "tools": {
    "docker": {
      "enabled": true,
      "host": "tcp://docker-host:2376",
      "tls_verify": true,
      "cert_path": "/path/to/certs"
    }
  }
}

​

Example Queries

​

Check Container Status

@incidentfox what containers are running on the app server?

​

Get Container Logs

@incidentfox show me logs from the nginx container for the last 30 minutes

​

Check Resource Usage

@incidentfox what is the CPU and memory usage of the api container?

​

Execute Diagnostic Command

@incidentfox run 'netstat -an' in the web container

​

Use Cases

​

Container Health Investigation

1. Check container status with docker_ps
2. Review logs with docker_logs
3. Inspect configuration with docker_inspect
4. Check resource usage with docker_stats

​

Network Debugging

1. List networks with docker_networks
2. Inspect container network settings
3. Use docker_exec to run network diagnostics

​

Resource Exhaustion

1. Check docker_stats for CPU/memory usage
2. Review docker_events for OOM kills
3. Analyze docker_diff for unexpected file changes

​

Security Considerations

​

Principle of Least Privilege

​

Approval Workflow for Exec

{
  "tools": {
    "docker_exec": {
      "enabled": true,
      "require_approval": true,
      "allowed_commands": ["ps", "netstat", "cat /etc/hosts"]
    }
  }
}

​

Troubleshooting

​

Permission Denied

Error: permission denied while trying to connect to Docker socket

1. Add the IncidentFox service user to the docker group
2. Use TCP API with proper authentication
3. Use sudo with proper configuration

​

Container Not Found

​

Next Steps