docker

With Docker daemon access, docker cp pulls individual files out of any container's filesystem, docker export writes a tar snapshot of a container's whole filesystem, and docker save archives full images (all layers/history). Together they let an operator harvest other containers' files, embedded secrets and build-time credentials from a single node.

Use Collect files, filesystem snapshots and image layers (with baked-in secrets) from colocated containers.

docker cp CONTAINERID:/etc/shadow /tmp/x
docker export CONTAINERID -o /tmp/x.tar
docker save IMAGE:latest -o /tmp/x.tar

Context

admin

Native

Collection, Data Staging

MITRE

T1005

Detection

Detection: docker events for export/save/cp actions and auditd for large tar writes by dockerd; flag export/save of containers or images the user did not create, and cp reads of sensitive paths (/etc/shadow, mounted secret volumes). Baseline legitimate backup jobs to reduce noise.

Verified

✓ docker export/save/cp CLI docs confirm the commands and -o/--output (export page fetched live). Criterion (e) caveat: `docker cp` overlaps the existing GTFOBins docker File-read/File-write functions, but `docker export`/`docker save` (whole-filesystem and whole-image tar for bulk collection, T1005) are additive and absent from GTFOBins — kept for that additive value.

Refs

docs.docker.com/reference/cli/docker/container/export/

docs.docker.com/reference/cli/docker/image/save/

attack.mitre.org/techniques/T1005/