osquery dockerのimage一覧を抽出する

作成日 2021.05.31
osquery
osquery

osqueryで、dockerのimage一覧を抽出するクエリを記述してます。

1. 環境
2. 一覧を抽出

環境

OS Ubuntu20.04
osquery 4.8.0

Osqueryのインストールはこちら

一覧を抽出

osqueryiを実行して、対話モードでクエリを実行します。

osqueryi

dockerのimage一覧を抽出するには、以下のクエリを実行します。

osquery> select * from docker_images;

<出力結果>
+------------------------------------------------------------------+------------+------------+----------------------------------+
| id                                                               | created    | size_bytes | tags                             |
+------------------------------------------------------------------+------------+------------+----------------------------------+
| d1a364dc548d5357f0da3268c888e1971bbdb957ee3f028fe7194f1d61c6fdee | 1621957423 | 133117876  | nginx:latest                     |
| eff629089685eb7051a239d4217f334580c09e557a9ecfeb2d562a1229d10e7f | 1621906324 | 407555827  | mariadb:latest                   |
| 5af61953cacb284c0d4e642a729a2d4aa6d4cf063f661ccee7ef6ba38534e51d | 1621659865 | 859681561  | nextcloud:fpm                    |
| 30594f63d46c7886d2e40856403b120dfe338db8c10070d519d7bda7aa25d158 | 1621385895 | 2569101499 | onlyoffice/documentserver:latest |
+------------------------------------------------------------------+------------+------------+----------------------------------+

image以外にも、ネットワークや

select * from docker_networks;

<出力結果>
+------------------------------------------------------------------+-------------------------------------+--------+------------+-------------+---------------+------------+
| id                                                               | name                                | driver | created    | enable_ipv6 | subnet        | gateway    |
+------------------------------------------------------------------+-------------------------------------+--------+------------+-------------+---------------+------------+
| aacf5bcb1934bb9e65c7e04705d3804149e0992bc958d01489f8b4f2e489f2a0 | host                                | host   | 1621988969 | 0           |               |            |
| 1da612db3f71237914bc970ccc62f24338b3bf4b093fa7e4524b0d41922d0318 | docker-onlyoffice-nextcloud_default | bridge | 1621990172 | 0           | 172.18.0.0/16 | 172.18.0.1 |
| aa24ca9cd7be68860acbc94a9db50c27a8662ee2265c6bb3ec9bbeb09420af0b | bridge                              | bridge | 1622084377 | 0           | 172.17.0.0/16 | 172.17.0.1 |
| 46b35c7cccc4ecd58d2e17794371dc518a76875b1c896ccc3ef900269bc78445 | none                                | null   | 1621988969 | 0           |               |            |
+------------------------------------------------------------------+-------------------------------------+--------+------------+-------------+---------------+------------+

valumeも確認することが可能です。

select * from docker_volumes;

<出力結果>
+------------------------------------------------------------------+--------+------------------------------------------------------------------------------------------------+------+
| name                                                             | driver | mount_point                                                                                    | type |
+------------------------------------------------------------------+--------+------------------------------------------------------------------------------------------------+------+
| docker-onlyoffice-nextcloud_document_data                        | local  | /var/lib/docker/volumes/docker-onlyoffice-nextcloud_document_data/_data                        |      |
| docker-onlyoffice-nextcloud_mysql_data                           | local  | /var/lib/docker/volumes/docker-onlyoffice-nextcloud_mysql_data/_data                           |      |
| 1bfe28a93c9eac2674781a7178abf785af71e1df5ad94999d6c7bb15ab4e4899 | local  | /var/lib/docker/volumes/1bfe28a93c9eac2674781a7178abf785af71e1df5ad94999d6c7bb15ab4e4899/_data |      |
| 2d83740558c70a94e4731ab30d413bd65b7ba84d0441f01b538edcb827916c5f | local  | /var/lib/docker/volumes/2d83740558c70a94e4731ab30d413bd65b7ba84d0441f01b538edcb827916c5f/_data |      |
| 7ab5578c86c3dd5f77896ac912f04a6aa27807b929d3a2f1ae4cc8dc21520da2 | local  | /var/lib/docker/volumes/7ab5578c86c3dd5f77896ac912f04a6aa27807b929d3a2f1ae4cc8dc21520da2/_data |      |
| bdd9905ab6e70a907e962fb502387e24fc63803199f2b690b09657fd95342b0f | local  | /var/lib/docker/volumes/bdd9905ab6e70a907e962fb502387e24fc63803199f2b690b09657fd95342b0f/_data |      |
| docker-onlyoffice-nextcloud_app_data                             | local  | /var/lib/docker/volumes/docker-onlyoffice-nextcloud_app_data/_data                             |      |
| docker-onlyoffice-nextcloud_document_log                         | local  | /var/lib/docker/volumes/docker-onlyoffice-nextcloud_document_log/_data                         |      |
| fa13a4dfb7d14a0091d62459c7349b245421f624bcd8ca8f4dc838704dab1065 | local  | /var/lib/docker/volumes/fa13a4dfb7d14a0091d62459c7349b245421f624bcd8ca8f4dc838704dab1065/_data |      |
+------------------------------------------------------------------+--------+------------------------------------------------------------------------------------------------+------+