Whoc – A Container Image That Extracts The Underlying Container Runtime

Click the icon to Follow me:- twitterTelegramRedditDiscord


Wait-For-Exec Mode

For statically linked container runtimes, whoc comes in another flavor: whoc:waitforexec.

  1. upload_runtime is the image entrypoint, and runs as the whoc container PID 1.
  2. The user is expected to exec into the whoc container and invoke a file pointing to /proc/self/exe (e.g. docker exec whoc-ctr /proc/self/exe)
  3. Once the exec occurs, the container runtime re-executes itself inside the container
  4. upload_runtime reads the runtime binary through /proc/<runtime-pid>/exe and sends it to the configured remote server

Try Locally

You’ll need docker and python3 installed. Clone the repository:

$ git clone [email protected]:twistlock/whoc.git

Set up a file server to receive the extracted container runtime:

$ cd whoc
$ mkdir -p stash && cd stash
$ ln -s ../util/fileserver.py fileserver
$ ./fileserver

From another shell, run the whoc image in your container environment of choice, for example Docker:

$ cd whoc
$ docker build -f Dockerfile_dynamic -t whoc:latest src # or ./util/build.sh
$ docker run --rm -it --net=host whoc:latest # or ./util/run_local.sh

See that the file server received the container runtime. Since we run whoc under vanilla Docker, the received container runtime should be runc.

--net=host is only used in local tests so that the whoc container could easily reach the fileserver on the host via


Help for whoc‘s main binary, upload_runtime:

Usage: upload_runtime [options] <server_ip>

-p, --port Port of remote server, defaults to 8080
-e, --exec Wait-for-exec mode for static container runtimes, waits until an exec to the container occurred
-b, --exec-bin In exec mode, overrides the default binary created for the exec, default is /bin/enter
-a, --exec-extra-argument In exec mode, pass an additional argument to the runtime so it won't exit quickly
-r, --exec-readdir-proc In exec mode, instead of guessing the runtime pid (which gives whoc one shot of catching the runtime),
find the runtime by searching for new processes under '/proc'
Download Whoc

If you like the site, please consider joining the telegram channel or supporting us on Patreon using the button below.


Original Source
Available for Amazon Prime