Cybersecurity Triage
Read-onlyReview Recent Docker Events
Something changed on the host and you need a quick timeline of recent Docker activity.
Command
docker events --since 30m --until 0sBefore you run this
System impact: Read-only. Low when scoped to the shown target.
When not to use it: Do not treat it as a permanent audit log; Docker events are not a compliance log.
Expected output
Timestamped Docker events such as start, die, pull, health_status, or restart.
System impact
Read-only. Nothing changes. Docker reads daemon events for a bounded time window.
Recovery / rollback: no state is changed.
When to use it
Use after an unexplained restart, image pull, container stop, or health-status change.
When not to use it
Do not treat it as a permanent audit log; Docker events are not a compliance log.
next steps
Related commands
Read Recent Docker Restart Events
Docker events show restart and die loops over time.
docker events --since 30m --until 0s
List Privileged Group Members
Group membership can grant more access than the username suggests.
awk -F: '$1 ~ /^(sudo|adm|docker)$/ && $4 != "" {print $1 ": " $4}' /etc/group
Build a Recent Apt Patch Timeline
Apt history turns patch claims into timestamps and package names.
awk '/^(Start-Date|Commandline|Upgrade|End-Date)/ {print}' /var/log/apt/history.log
Inspect Container Environment Names
Check what environment variables exist without printing their secret values.
docker inspect --format '{{range .Config.Env}}{{println .}}{{end}}' api | sed 's/=.*$/=<redacted>/'
Find SSH Key Users with sudo
The highest-priority access review starts where SSH keys and sudo overlap.
comm -12 <(find /home -path '*/.ssh/authorized_keys' -printf '%h\n' 2>/dev/null | awk -F/ '{print $(NF-1)}' | sort) <(awk -F: '$1=="sudo" {gsub(",","\n",$4); print $4}' /etc/group | sort)
Study mapping
Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.
Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.