How do I decrypt docker's own database?

mutakl · June 21, 2022, 8:11am

In docker’s file system, there are four DB files that are encrypted. How can I open them？
They are fscache.db，local-kv.db，meta.db and metadata.db.

rimelek · June 21, 2022, 9:29am

I have a tutorial where I write about those files too. I also have a script to build the database reader written in Go

If you are interested in the source code of the db reader, this is it:

github.com

itsziget/tutorial-docker-build/blob/33ead24d5c429cf0c8ef878f1148b80aefcdbd54/goapps/dockerdb-reader/dockerdb-reader.go

package main

// First clue: https://blog.qiqitori.com/2018/10/decoding-dockers-local-kv-db/
// New version created by etcd: https://github.com/etcd-io/bbolt
// Listing buckets: https://github.com/boltdb/bolt/issues/295#issuecomment-72381879
// removing non-printable characters: https://stackoverflow.com/questions/58994146/how-to-remove-non-printable-characters

import (
	"encoding/json"
	"fmt"
	"go.etcd.io/bbolt"
	"log"
	"os"
	"unicode"
)

func getContentAsJson(db *bbolt.DB) string {
	content := make(map[string]map[string]string)
	err := db.View(func(tx *bbolt.Tx) error {
		return tx.ForEach(func(nameAsBytes []byte, _ *bbolt.Bucket) error {

This file has been truncated. show original

You can also find the sources from which I learned how I could read these files.

Originally the format was “bolt”, which was a very simple key-value pair database. ETCD forked it and named it “bbolt”.

Just to make it easier to find, I share the clickable links too, how I learned about bbolt:

First clue: Decoding Docker’s local-kv.db – The Qiqitori Blogs
New version created by etcd: GitHub - etcd-io/bbolt: An embedded key/value database for Go.
Listing buckets: Would be great to have a function to get a list of buckets · Issue #295 · boltdb/bolt · GitHub
Removing non-printable characters: string - How to remove non-printable characters - Stack Overflow

mutakl · June 21, 2022, 10:12am

Thank you so much!!! I will have a try,thanks again.

mutakl · June 30, 2022, 2:58am

I did read something in local-kv.db,but I read nothing in other three databases.What did I do wrong?Or, is just nothing there? But they’re 32kb，I think they should have something.

Docker Community Forums

Docker Community Forums

How do I decrypt docker's own database?