When your container gets compromised

It's 3am. PagerDuty alerts: suspicious outbound connections from your API pod. By the time your on-call engineer logs in, Kubernetes has already restarted the pod. The container that was compromised? Gone. The evidence? Gone with it.

The Problem

Without continuous capture:

  • ✗Container logs show nothing unusual (attackers clean up)
  • ✗No memory dump to analyze for credentials or payloads
  • ✗No filesystem diff to see what was added or modified
  • ✗No network state showing where data was exfiltrated
  • ✗Incident report concludes: "Unable to determine root cause"

How reel Helps

Memory capture reveals what logs hide

Process memory often contains credentials, decrypted secrets, and attack payloads that never touch disk.

terminal
$ reel get checkpoint chk-api-server-20241210-030015 --extract memory

Analyzing memory dump...
Found: AWS_SECRET_ACCESS_KEY in process 1842 (python)
Found: Database connection string in process 1844 (node)
Found: Suspicious base64 payload in process 1850 (sh)
terminal
$ reel get layer layer-api-server-20241210-030015 --diff

Added:    /tmp/.hidden/backdoor.sh
Added:    /usr/local/bin/cryptominer
Modified: /etc/crontab
Modified: /root/.bashrc

Filesystem diff shows the attack

Compare the compromised state against the original image to see exactly what changed.

Network state captures connections

See what the container was connected to at the moment of capture.

terminal
$ reel get checkpoint chk-api-server-20241210-030015 --network

ESTABLISHED  10.0.1.15:443  →  185.234.72.x:4444  (suspicious C2)
ESTABLISHED  10.0.1.15:5432 →  10.0.2.100:5432    (database)
LISTEN       0.0.0.0:8080                          (expected)

The Outcome

Instead of "we don't know what happened," you have forensic evidence showing:

  • ✓How the attacker got in (memory analysis)
  • ✓What they installed (filesystem diff)
  • ✓Where they sent data (network state)
  • ✓The exact timeline of the compromise

Your incident report goes from "inconclusive" to "actionable intelligence."

Be prepared for your next incident

Coming soon. Deploys in minutes. Join the waitlist for early access.

Next: When the auditor asks →