Saluki

-- Detect privileged containers 
SELECT name, image, status 
FROM docker_containers 
WHERE privileged=1;

Saluki

-- See users who can access the Docker daemon
SELECT u.username 
FROM user_groups ug 
LEFT JOIN users u ON u.uid=ug.uid  
WHERE ug.gid IN (
  SELECT gid FROM groups WHERE groupname="docker"
);

Saluki

-- Search for a specific environment variable in all containers
SELECT name, env_variables 
FROM docker_containers 
WHERE env_variables LIKE "%NGINX_VERSION%";

Saluki

-- Detect profiles that are not running with AppArmor
SELECT name, image, state 
FROM docker_containers 
WHERE security_options NOT LIKE "%apparmor%";

Saluki

-- Detect contains with process that run with the root user
SELECT containers.name, processes.pid, processes.name, cmdline, user 
FROM docker_container_processes processes 
JOIN docker_containers containers ON containers.id=processes.id  
WHERE processes.id IN (
	SELECT id FROM docker_containers
) AND user="root";

Saluki

-- Retrieve images not used in active containers
SELECT id, tags 
FROM docker_images 
WHERE id NOT IN (
  SELECT image_id FROM docker_containers
);