SlideShare a Scribd company logo
Hacking Containers
Container Storage
Eng Teong Cheah
Microsoft MVP
Storage
The mechanism that Docker and several other container runtimes use is know as a union
file system (UnionFS).
To best understand a union file system, consider a set of clear pieces of transparent paper.
One paper at the bottom has a single line; let’s call this the lower layer.
The next piece of paper placed on top of it, also translucent, has a line connecting to the
first, and the picture that’s formed shows two lines making a 90 degree angle.
The next piece of paper is overlayed on top, and that paper has a third line connecting to
the first two lines; this picture forms a square U. We’ll call this the layer upper.
Storage
The final sheet of paper on top we’ll call the workdir; it completes the picture, and we see
a square.
The layering represents how the overlay file system, which is in use in Docker, uses layers
that include diffs between each layer on our disk.
Storage
Storage
We can inspect these changes using the docker inspect and docker volume commands.
We can also traverse the file system to the areas that correspond to the file system layers.
Each file system layer is SHA-256 hashed and checked for integrity, as these file systems
are supposed to be read-only.
The mechanism used to create each layer is actually in the Dockerfile.
Demo
Container Storage
References
Gray Hat Hacking, Sixth Edition

More Related Content

Similar to Hacking Containers - Container Storage (20)

PPTX
Docker 1.5
rajdeep
 
PDF
Kubernetes Docker Forensics & Incident Response.pdf
Christopher Doman
 
PDF
Docker hands-on
Dharmit Shah
 
PPTX
Containerized Applications Overview
Apoorv Anand
 
PDF
Cloud Native Computing - Part III - Containers
Linjith Kunnon
 
PDF
Introduction to Docker storage, volume and image
ejlp12
 
PDF
A Gentle Introduction to Docker and Containers
Docker, Inc.
 
PDF
Containers in depth – Understanding how containers work to better work with c...
All Things Open
 
PDF
A curtain-raiser to the container world Docker & Kubernetes
zekeLabs Technologies
 
PPTX
Container & kubernetes
Ted Jung
 
PDF
Docker introduction
Julien Maitrehenry
 
PDF
Containers in depth – Understanding how containers work to better work with c...
All Things Open
 
ODP
Linux containers & Devops
Maciej Lasyk
 
PDF
Docker intro
Frei Zhang
 
PDF
Workshop Docker 101
Dennis Laumen
 
PPTX
Docker 101 : Introduction to Docker and Containers
Yajushi Srivastava
 
PPTX
What’s the Deal with Containers, Anyway?
Stephen Foskett
 
PDF
Nodejs OC Docker and Node
Jeff Horn
 
PDF
Introduction to Docker and all things containers, Docker Meetup at RelateIQ
dotCloud
 
PDF
A Gentle Introduction To Docker And All Things Containers
Jérôme Petazzoni
 
Docker 1.5
rajdeep
 
Kubernetes Docker Forensics & Incident Response.pdf
Christopher Doman
 
Docker hands-on
Dharmit Shah
 
Containerized Applications Overview
Apoorv Anand
 
Cloud Native Computing - Part III - Containers
Linjith Kunnon
 
Introduction to Docker storage, volume and image
ejlp12
 
A Gentle Introduction to Docker and Containers
Docker, Inc.
 
Containers in depth – Understanding how containers work to better work with c...
All Things Open
 
A curtain-raiser to the container world Docker & Kubernetes
zekeLabs Technologies
 
Container & kubernetes
Ted Jung
 
Docker introduction
Julien Maitrehenry
 
Containers in depth – Understanding how containers work to better work with c...
All Things Open
 
Linux containers & Devops
Maciej Lasyk
 
Docker intro
Frei Zhang
 
Workshop Docker 101
Dennis Laumen
 
Docker 101 : Introduction to Docker and Containers
Yajushi Srivastava
 
What’s the Deal with Containers, Anyway?
Stephen Foskett
 
Nodejs OC Docker and Node
Jeff Horn
 
Introduction to Docker and all things containers, Docker Meetup at RelateIQ
dotCloud
 
A Gentle Introduction To Docker And All Things Containers
Jérôme Petazzoni
 

More from Eng Teong Cheah (20)

PDF
Modern Cross-Platform Apps with .NET MAUI
Eng Teong Cheah
 
PDF
Efficiently Removing Duplicates from a Sorted Array
Eng Teong Cheah
 
PDF
Monitoring Models
Eng Teong Cheah
 
PDF
Responsible Machine Learning
Eng Teong Cheah
 
PDF
Training Optimal Models
Eng Teong Cheah
 
PDF
Deploying Models
Eng Teong Cheah
 
PDF
Machine Learning Workflows
Eng Teong Cheah
 
PDF
Working with Compute
Eng Teong Cheah
 
PDF
Working with Data
Eng Teong Cheah
 
PDF
Experiments & TrainingModels
Eng Teong Cheah
 
PDF
Automated Machine Learning
Eng Teong Cheah
 
PDF
Getting Started with Azure Machine Learning
Eng Teong Cheah
 
PDF
Hacking Containers - Looking at Cgroups
Eng Teong Cheah
 
PDF
Hacking Containers - Linux Containers
Eng Teong Cheah
 
PDF
Data Security - Storage Security
Eng Teong Cheah
 
PDF
Application Security- App security
Eng Teong Cheah
 
PDF
Application Security - Key Vault
Eng Teong Cheah
 
PDF
Compute Security - Container Security
Eng Teong Cheah
 
PDF
Compute Security - Host Security
Eng Teong Cheah
 
PDF
Virtual Networking Security - Network Security
Eng Teong Cheah
 
Modern Cross-Platform Apps with .NET MAUI
Eng Teong Cheah
 
Efficiently Removing Duplicates from a Sorted Array
Eng Teong Cheah
 
Monitoring Models
Eng Teong Cheah
 
Responsible Machine Learning
Eng Teong Cheah
 
Training Optimal Models
Eng Teong Cheah
 
Deploying Models
Eng Teong Cheah
 
Machine Learning Workflows
Eng Teong Cheah
 
Working with Compute
Eng Teong Cheah
 
Working with Data
Eng Teong Cheah
 
Experiments & TrainingModels
Eng Teong Cheah
 
Automated Machine Learning
Eng Teong Cheah
 
Getting Started with Azure Machine Learning
Eng Teong Cheah
 
Hacking Containers - Looking at Cgroups
Eng Teong Cheah
 
Hacking Containers - Linux Containers
Eng Teong Cheah
 
Data Security - Storage Security
Eng Teong Cheah
 
Application Security- App security
Eng Teong Cheah
 
Application Security - Key Vault
Eng Teong Cheah
 
Compute Security - Container Security
Eng Teong Cheah
 
Compute Security - Host Security
Eng Teong Cheah
 
Virtual Networking Security - Network Security
Eng Teong Cheah
 

Recently uploaded (20)

PDF
New from BookNet Canada for 2025: BNC BiblioShare - Tech Forum 2025
BookNet Canada
 
PDF
Presentation - Vibe Coding The Future of Tech
yanuarsinggih1
 
PDF
Building Real-Time Digital Twins with IBM Maximo & ArcGIS Indoors
Safe Software
 
PDF
SWEBOK Guide and Software Services Engineering Education
Hironori Washizaki
 
PDF
HubSpot Main Hub: A Unified Growth Platform
Jaswinder Singh
 
PDF
Empower Inclusion Through Accessible Java Applications
Ana-Maria Mihalceanu
 
PDF
Exolore The Essential AI Tools in 2025.pdf
Srinivasan M
 
PPTX
AUTOMATION AND ROBOTICS IN PHARMA INDUSTRY.pptx
sameeraaabegumm
 
PDF
CIFDAQ Token Spotlight for 9th July 2025
CIFDAQ
 
PDF
Jak MŚP w Europie Środkowo-Wschodniej odnajdują się w świecie AI
dominikamizerska1
 
PDF
HCIP-Data Center Facility Deployment V2.0 Training Material (Without Remarks ...
mcastillo49
 
PDF
Blockchain Transactions Explained For Everyone
CIFDAQ
 
PDF
CIFDAQ Weekly Market Wrap for 11th July 2025
CIFDAQ
 
PPTX
Building Search Using OpenSearch: Limitations and Workarounds
Sease
 
PDF
Transcript: New from BookNet Canada for 2025: BNC BiblioShare - Tech Forum 2025
BookNet Canada
 
PPTX
"Autonomy of LLM Agents: Current State and Future Prospects", Oles` Petriv
Fwdays
 
PDF
Bitcoin for Millennials podcast with Bram, Power Laws of Bitcoin
Stephen Perrenod
 
PDF
Log-Based Anomaly Detection: Enhancing System Reliability with Machine Learning
Mohammed BEKKOUCHE
 
PDF
How Startups Are Growing Faster with App Developers in Australia.pdf
India App Developer
 
PDF
The Builder’s Playbook - 2025 State of AI Report.pdf
jeroen339954
 
New from BookNet Canada for 2025: BNC BiblioShare - Tech Forum 2025
BookNet Canada
 
Presentation - Vibe Coding The Future of Tech
yanuarsinggih1
 
Building Real-Time Digital Twins with IBM Maximo & ArcGIS Indoors
Safe Software
 
SWEBOK Guide and Software Services Engineering Education
Hironori Washizaki
 
HubSpot Main Hub: A Unified Growth Platform
Jaswinder Singh
 
Empower Inclusion Through Accessible Java Applications
Ana-Maria Mihalceanu
 
Exolore The Essential AI Tools in 2025.pdf
Srinivasan M
 
AUTOMATION AND ROBOTICS IN PHARMA INDUSTRY.pptx
sameeraaabegumm
 
CIFDAQ Token Spotlight for 9th July 2025
CIFDAQ
 
Jak MŚP w Europie Środkowo-Wschodniej odnajdują się w świecie AI
dominikamizerska1
 
HCIP-Data Center Facility Deployment V2.0 Training Material (Without Remarks ...
mcastillo49
 
Blockchain Transactions Explained For Everyone
CIFDAQ
 
CIFDAQ Weekly Market Wrap for 11th July 2025
CIFDAQ
 
Building Search Using OpenSearch: Limitations and Workarounds
Sease
 
Transcript: New from BookNet Canada for 2025: BNC BiblioShare - Tech Forum 2025
BookNet Canada
 
"Autonomy of LLM Agents: Current State and Future Prospects", Oles` Petriv
Fwdays
 
Bitcoin for Millennials podcast with Bram, Power Laws of Bitcoin
Stephen Perrenod
 
Log-Based Anomaly Detection: Enhancing System Reliability with Machine Learning
Mohammed BEKKOUCHE
 
How Startups Are Growing Faster with App Developers in Australia.pdf
India App Developer
 
The Builder’s Playbook - 2025 State of AI Report.pdf
jeroen339954
 

Hacking Containers - Container Storage

  • 3. Storage The mechanism that Docker and several other container runtimes use is know as a union file system (UnionFS). To best understand a union file system, consider a set of clear pieces of transparent paper. One paper at the bottom has a single line; let’s call this the lower layer. The next piece of paper placed on top of it, also translucent, has a line connecting to the first, and the picture that’s formed shows two lines making a 90 degree angle. The next piece of paper is overlayed on top, and that paper has a third line connecting to the first two lines; this picture forms a square U. We’ll call this the layer upper.
  • 4. Storage The final sheet of paper on top we’ll call the workdir; it completes the picture, and we see a square. The layering represents how the overlay file system, which is in use in Docker, uses layers that include diffs between each layer on our disk.
  • 6. Storage We can inspect these changes using the docker inspect and docker volume commands. We can also traverse the file system to the areas that correspond to the file system layers. Each file system layer is SHA-256 hashed and checked for integrity, as these file systems are supposed to be read-only. The mechanism used to create each layer is actually in the Dockerfile.