How do I decrypt docker's own database?

In docker’s file system, there are four DB files that are encrypted. How can I open them?
They are fscache.db,local-kv.db,meta.db and metadata.db.

I have a tutorial where I write about those files too. I also have a script to build the database reader written in Go

If you are interested in the source code of the db reader, this is it:

You can also find the sources from which I learned how I could read these files.

Originally the format was “bolt”, which was a very simple key-value pair database. ETCD forked it and named it “bbolt”.

Just to make it easier to find, I share the clickable links too, how I learned about bbolt:

1 Like

Thank you so much!!! I will have a try,thanks again.

I did read something in local-kv.db,but I read nothing in other three databases.What did I do wrong?Or, is just nothing there? But they’re 32kb,I think they should have something.

local-kv.db is the database of networks and Docker always has some default networks. I haven’t read the buildkit databases, but if you don’t use buildkit, I guess that can be empty too. An other file is metadata.db under volumes. If you don’t have any volume, that also can be empty.

That 32kb is the default minimum size. When you add volumes, the volume db will be increased to 64 kb, then 128 kb. So the filesize is not the same as the size of the usable data in it.

1 Like

Oh, I see. Thank you!