README.md

docker-osquery

osquery in slim debian container

How to run?

# docker run -it --rm emblica/osquery osqueryi

osquery> select * from routes;
+-----------------+---------+------------+------------+-------+-----------+-----+--------+-----------+
| destination     | netmask | gateway    | source     | flags | interface | mtu | metric | type      |
+-----------------+---------+------------+------------+-------+-----------+-----+--------+-----------+
| 0.0.0.0         | 0       | 172.17.0.1 |            | 0     | eth0      | 0   | 0      | gateway   |
| 172.17.0.0      | 16      |            | 172.17.0.2 | 0     | eth0      | 0   | 0      | gateway   |
| 127.0.0.0       | 0       |            | 127.0.0.1  | 0     | lo        | 0   | 0      | broadcast |
| 127.0.0.0       | 8       |            | 127.0.0.1  | 0     | lo        | 0   | 0      | local     |
| 127.0.0.1       | 0       |            | 127.0.0.1  | 0     | lo        | 0   | 0      | local     |
| 127.255.255.255 | 0       |            | 127.0.0.1  | 0     | lo        | 0   | 0      | broadcast |
| 172.17.0.0      | 0       |            | 172.17.0.2 | 0     | eth0      | 0   | 0      | broadcast |
| 172.17.0.2      | 0       |            | 172.17.0.2 | 0     | eth0      | 0   | 0      | local     |
| 172.17.255.255  | 0       |            | 172.17.0.2 | 0     | eth0      | 0   | 0      | broadcast |
| 0.0.0.0         | 0       |            |            | 0     | lo        | 0   | -1     | other     |
| 0.0.0.0         | 0       |            |            | 0     | lo        | 0   | -1     | other     |
+-----------------+---------+------------+------------+-------+-----------+-----+--------+-----------+