Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Intelligence View
⚡ tsecurity.de Intelligence

Docker – Image and Container Bonding & Client-Server Architecture

Question: A container is running from an image. If we try to delete the image while the container is running, why can't we delete the image? Answer: If we attempt to delete the image, Docker will display an error message…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!




Question:



A container is running from an image. If we try to delete the image while the container is running, why can't we delete the image?






Answer:



If we attempt to delete the image, Docker will display an error message stating that the image is being used by a container.



The reason is that each line in a Dockerfile creates a layer.



Each layer is a read-only layer. Once a layer is created, it cannot be modified. If we want to make changes to the image, we need to create a new Dockerfile and build a new image.



When we create a container, only a reference to the image layers is passed to the container. The container has a writable layer, meaning we can create files, modify files, or generate output inside the container. These changes reside only in the container and do not affect the image.



However, the container always depends on the image. That is why we cannot delete the image while the container is using it.



This methodology is called Copy-on-Write (CoW).









Question:



If an image size is 10 GB, what will be the container size?






Answer:



A container contains only references to the image layers. Therefore, the container size consists of the files and changes stored in the writable layer running inside the container.









Question:



What command is used to find the size of a container?




docker ps --size






The Dive application is used to analyze each layer in a Docker image.









Client-Server Architecture



Docker works based on the Client-Server Architecture.



The Docker client sends requests to the Docker daemon, and the Docker daemon responds to the client.



If a requested image is not found on the local system, Docker retrieves it from a public repository.




docker run hello-world






This command pulls the image from the repository and runs it on the local system.









To pull an image from an image repository






docker pull busybox:1.36









To create a container






docker run busybox:1.36









To create a container, execute the ls command inside it, and exit immediately






docker run busybox:1.36 ls









To create a container and enter interactive mode






docker run -it busybox:1.36












Interview Questions






Question 1:



In a Client-Server architecture, who sends requests to the server?



Answer: The client.









Question 2:



What happens when a container is created from an image?



Answer: A writable layer is created.









Question 3:



What is the purpose of the writable layer in a container?



Answer: To handle file modifications and store changes made inside the container.









Question 4:



The read-only layers in Docker come from what?



Answer: The base image and its image layers.









Question 5:



What happens to the writable layer when the container is deleted?



Answer: It is discarded.









Question 6:



In a Docker environment, the client interacts with what?



Answer: The Docker daemon.









Question 7:



How do you start a container in interactive mode?



Answer:




docker run -it <image-name>


1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Vulnerability Remediation & Verification
Syntax validiert (0 Fehler)
title: Detect Exploitation - Docker – Image and Container Bonding & Client-Server Architecture
id: 8154f067-b99c-49eb-9e2e-39c471b5b519
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-26
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
Syntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-26"
        description = "YARA Signature for "
    strings:
        $str = "Docker – Image and Container B" ascii wide
    condition:
        any of them
}
Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("Docker  Image and Container Bonding  Cli")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
Syntax validiert (0 Fehler)
message: "*Docker  Image and Container Bonding  Cli*"
Syntax validiert (0 Fehler)
CommonSecurityLog
| where Message has "Docker  Image and Container Bonding  Cli"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

2. Cyber Threat Intelligence & Forensik

🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich Docker – Image and Container Bonding &amp; C.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten Docker – Image and Container Bonding & Client-Server Architecture

Thematisch verwandte Begriffe: Docker, Image, Container, Bonding · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-100536 | OpenClaw versions before 2026.8.1 fail to validate all source fields in…
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag