dissect.target.filesystems.overlay

Module Contents

Classes

Overlay2Filesystem

Overlay 2 filesystem implementation.

Attributes

log

dissect.target.filesystems.overlay.log

class dissect.target.filesystems.overlay.Overlay2Filesystem(path: pathlib.Path, *args, **kwargs)

Bases: dissect.target.filesystem.LayerFilesystem

Overlay 2 filesystem implementation.

Deleted files will be present on the reconstructed filesystem. Volumes and bind mounts will be added to their respective mount locations. Does not support tmpfs mounts.

References

• https://docs.docker.com/storage/storagedriver/

• https://docs.docker.com/storage/volumes/

• https://www.didactic-security.com/resources/docker-forensics.pdf

• https://www.didactic-security.com/resources/docker-forensics-cheatsheet.pdf

• https://github.com/google/docker-explorer

__type__ = 'overlay2'

__repr__() → str

Return repr(self).