dissect.target.filesystems.overlay

Module Contents

Classes

Overlay2Filesystem	Docker Overlay 2 filesystem implementation.
OverlayFilesystem	Podman overlay filesystem implementation.

Functions

oci_layers

Yield the layers of an OCI container provided the mount_path.

Attributes

log

dissect.target.filesystems.overlay.log

class dissect.target.filesystems.overlay.Overlay2Filesystem(path: pathlib.Path, *args, **kwargs)

Bases: dissect.target.filesystem.LayerFilesystem

Docker Overlay 2 filesystem implementation.

Deleted files will be present on the reconstructed filesystem. Volumes and bind mounts will be added to their respective mount locations. Does not support tmpfs mounts.

References

• https://docs.docker.com/engine/storage/drivers/overlayfs-driver/

• https://docs.docker.com/storage/storagedriver/

• https://docs.docker.com/storage/volumes/

• https://www.didactic-security.com/resources/docker-forensics.pdf

• https://www.didactic-security.com/resources/docker-forensics-cheatsheet.pdf

• https://github.com/google/docker-explorer

__type__ = 'overlay2'

A short string identifying the type of filesystem.

base_path

__repr__() → str

class dissect.target.filesystems.overlay.OverlayFilesystem(path: pathlib.Path, *args, **kwargs)

Bases: dissect.target.filesystem.LayerFilesystem

Podman overlay filesystem implementation.

Currently does not support mounting of (anonymous) volumes, named volumes and bind mounts. Also does not map mount point files, hosts, hostname and resolv.conf files.

References

• https://github.com/containers/podman

• https://docs.podman.io/en/latest/

__type__ = 'overlay'

A short string identifying the type of filesystem.

base_path

__repr__() → str

dissect.target.filesystems.overlay.oci_layers(path: pathlib.Path) → collections.abc.Iterator[tuple[str, pathlib.Path]]

Yield the layers of an OCI container provided the mount_path.