How do I decrypt docker's own database?

mutakl · June 21, 2022, 8:11am

In docker’s file system, there are four DB files that are encrypted. How can I open them？
They are fscache.db，local-kv.db，meta.db and metadata.db.

rimelek · June 21, 2022, 9:29am

I have a tutorial where I write about those files too. I also have a script to build the database reader written in Go

If you are interested in the source code of the db reader, this is it:

github.com

itsziget/tutorial-docker-build/blob/33ead24d5c429cf0c8ef878f1148b80aefcdbd54/goapps/dockerdb-reader/dockerdb-reader.go

package main

// First clue: https://blog.qiqitori.com/2018/10/decoding-dockers-local-kv-db/
// New version created by etcd: https://github.com/etcd-io/bbolt
// Listing buckets: https://github.com/boltdb/bolt/issues/295#issuecomment-72381879
// removing non-printable characters: https://stackoverflow.com/questions/58994146/how-to-remove-non-printable-characters

import (
	"encoding/json"
	"fmt"
	"go.etcd.io/bbolt"
	"log"
	"os"
	"unicode"
)

func getContentAsJson(db *bbolt.DB) string {
	content := make(map[string]map[string]string)
	err := db.View(func(tx *bbolt.Tx) error {
		return tx.ForEach(func(nameAsBytes []byte, _ *bbolt.Bucket) error {

This file has been truncated. show original

You can also find the sources from which I learned how I could read these files.

Originally the format was “bolt”, which was a very simple key-value pair database. ETCD forked it and named it “bbolt”.

Just to make it easier to find, I share the clickable links too, how I learned about bbolt:

First clue: Decoding Docker’s local-kv.db – The Qiqitori Blogs
New version created by etcd: GitHub - etcd-io/bbolt: An embedded key/value database for Go.
Listing buckets: Would be great to have a function to get a list of buckets · Issue #295 · boltdb/bolt · GitHub
Removing non-printable characters: string - How to remove non-printable characters - Stack Overflow

mutakl · June 21, 2022, 10:12am

Thank you so much!!! I will have a try,thanks again.

mutakl · June 30, 2022, 2:58am

I did read something in local-kv.db,but I read nothing in other three databases.What did I do wrong?Or, is just nothing there? But they’re 32kb，I think they should have something.

rimelek · July 3, 2022, 11:11pm

local-kv.db is the database of networks and Docker always has some default networks. I haven’t read the buildkit databases, but if you don’t use buildkit, I guess that can be empty too. An other file is metadata.db under volumes. If you don’t have any volume, that also can be empty.

That 32kb is the default minimum size. When you add volumes, the volume db will be increased to 64 kb, then 128 kb. So the filesize is not the same as the size of the usable data in it.

mutakl · July 5, 2022, 6:50am

Oh, I see. Thank you!