Docker Community Forums

Share and learn in the Docker community.

What is the image d4w/nsenter. It keeps coming back after I delete it. Is this malware?

Does anyone know what this image is? It keeps appearing when I run “docker images” every time after a docker restart. I have ran “docker rmi 9e4f13a0901e” to delete the image but after a docker restart, it is present again. Sometimes it even has a running container. When here is a running container of this n4w/nsenter image, the docker whale displays the message that docker is starting. How is it possible that this container is running while Docker is just trying to start up?

I have to stop the container by running "docker stop ", then the Docker whale will show that Docker is running and a message is displayed that I can hack away with powershell.

Below is the image and container image. Any help or info would be great. I just need to know if it is malware.
docker ps output:
fd33be552913 d4w/nsenter “/usr/bin/nsenter1 /b” 59 minutes ago Up 59 minutes mad_roentgen

docker images output
d4w/nsenter latest 9e4f13a0901e 3 months ago 83.85 kB

I just located a filed named nsenter.tar in C:\Program Files\Docker\Docker\resources. Should this file be there? I removed the nsenter.tar file and restarted Docker. This time the d4w/nsenter container and image do not appear.

Still need to know if the file is expected there or is this malware.


This is a part of the Docker for Windows setup!

It’s not supposed to run in perpetuity though - can create an issue and upload diagnostics here:

Awesome!, Thank you, Michael. I just got nervous when this image and container kept appearing with me running any commands.

I just put the nsenter.tar back in the Docker/Docker/resources/ directory and restarted Docker. This time, the nsenter container ran only for a few moments and then exited. I’ll keep an eye on each time I restart Docker or my machine and I’ll upload any info I can capture to the GitHub link you’ve provided.

Again, thank you!