Docker Community Forums

Share and learn in the Docker community.

Any way to tell where a file in overlay2 is used?

General Discussions
#1

In a large Docker swarm, I have a number of software installs that have a security hole. The files show up on worker node filesystem sweeps(containers aren’t swept), in the overlay2 directory. How can I tell what image or container is using those files?

#2

A swarm task does only provide details about the TaskSpecs, thus no details about the container it creates. Basicly it is impossible to gather the details from a master node.

You will have to connect to each node and execute following command to determin which path is owned by which container:

for container in $(docker ps --all --quiet --format '{{ .Names }}'); do 
  echo "/var/lib/docker/containers/$(docker inspect $container --format '{{.Id}}') = $container"
done

my bad, I concentrated on the container instead of the overlay2 folder. Let me see, if there is a way for that as well…

There is:

for container in $(docker ps --all --quiet --format '{{ .Names }}'); do 
  echo "$(docker inspect $container --format '{{.GraphDriver.Data.MergedDir }}' | sed 's#/\([^az]*\)\.*$##' ) = $container"
done

Merged, Workdir, UpperDir all share the same subfolder. So identifying any one of those helps to find the folder. The sed command should cut of the specific subfolder.

#3

I couldn’t resist: I created a docker-compose stack that deploys a container as global service, queries the details from all containers on the node and then terminates the container on the node. Make sure to wait until each task of the stack is completed before your fetch the logs and delete the stack.

docker-compose.yml:

version: '3.7'
services:
  inventory:
    image: docker
    deploy:
      mode: global
      restart_policy:
        condition: none
    volumes:
    -  /var/run/docker.sock:/var/run/docker.sock
    environment:
      NODE_HOSTNAME: '{{.Node.Hostname}}'
    entrypoint: >
      sh -c "for container in $$(docker ps --all --quiet --format '{{ .Names }}'); do \
        echo \"$$(docker inspect $$container --format '{{.GraphDriver.Data.MergedDir }}' | sed 's#/\([^az]*\)\.*$$##' ) = $$NODE_HOSTNAME.$$container\" ;\
      done"