As a system administrator dealing with security incidents, you’ll inevitably encounter situations where you need to analyze suspicious files. Running malware on your production systems? Absolutely not. That’s where Docker comes in—providing isolated, disposable environments for safe malware analysis.
Why Docker for Malware Analysis?
Docker containers offer several advantages for malware analysis:
- Isolation: Containers run in isolated namespaces, separate from the host
- Disposability: Spin up, analyze, destroy—no traces left
- Reproducibility: Same environment every time
- Resource Control: Limit CPU, memory, and disk access
- Network Isolation: Complete control over network access
⚠️ Important: Docker is NOT a security boundary like a VM. For highly sophisticated malware, use a proper VM with snapshots. Docker is suitable for initial triage and less sophisticated samples.
Setting Up the Analysis Environment
Step 1: Create the Isolated Network
First, create a completely isolated Docker network with no external access:
# Create isolated network with no internet access
docker network create \
--driver bridge \
--internal \
--subnet 172.28.0.0/16 \
malware-net
The --internal flag is critical—it prevents any outbound internet connectivity.
Step 2: Build the Analysis Container
Create a Dockerfile for your analysis environment:
FROM ubuntu:22.04
# Prevent interactive prompts
ENV DEBIAN_FRONTEND=noninteractive
# Install analysis tools
RUN apt-get update && apt-get install -y \
strace \
ltrace \
gdb \
radare2 \
file \
binutils \
hexedit \
xxd \
net-tools \
tcpdump \
wireshark-common \
python3 \
python3-pip \
&& rm -rf /var/lib/apt/lists/*
# Install Python analysis tools
RUN pip3 install pefile yara-python capstone
# Create non-root analysis user
RUN useradd -m -s /bin/bash analyst
RUN mkdir -p /samples /output
RUN chown analyst:analyst /samples /output
# Drop to non-root user
USER analyst
WORKDIR /samples
CMD ["/bin/bash"]
Build the image:
docker build -t malware-sandbox .
Step 3: Run with Maximum Restrictions
Launch the container with strict security constraints:
docker run -it --rm \
--name malware-analysis \
--network malware-net \
--cap-drop ALL \
--security-opt no-new-privileges:true \
--security-opt seccomp=default \
--read-only \
--tmpfs /tmp:rw,noexec,nosuid,size=100m \
--memory 512m \
--cpus 1 \
--pids-limit 100 \
-v "$(pwd)/samples:/samples:ro" \
-v "$(pwd)/output:/output:rw" \
malware-sandbox
Let’s break down these security flags:
| Flag | Purpose |
|---|---|
--cap-drop ALL | Remove all Linux capabilities |
--no-new-privileges | Prevent privilege escalation |
--read-only | Read-only root filesystem |
--tmpfs /tmp | Writable temp with noexec |
--memory 512m | Limit memory to prevent fork bombs |
--pids-limit 100 | Limit process count |
Static Analysis Workflow
Once inside the container, start with static analysis—examining the file without executing it:
File Type Identification
file suspicious_binary
strings suspicious_binary | head -50
Check for Packing/Obfuscation
# Check entropy (high entropy = packed/encrypted)
rabin2 -H suspicious_binary
# Check sections
readelf -S suspicious_binary
Extract Indicators of Compromise (IOCs)
# Extract URLs, IPs, emails
strings suspicious_binary | grep -E "(http|https|ftp)://"
strings suspicious_binary | grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b"
Dynamic Analysis (Behavioral)
For dynamic analysis, you need execution capabilities. Create a separate, even more isolated container:
docker run -it --rm \
--name malware-dynamic \
--network none \
--cap-drop ALL \
--security-opt no-new-privileges:true \
--memory 256m \
--cpus 0.5 \
-v "$(pwd)/samples:/samples:ro" \
malware-sandbox
Trace System Calls
# Trace all syscalls
strace -f -o /output/strace.log ./suspicious_binary
# Trace library calls
ltrace -f -o /output/ltrace.log ./suspicious_binary
Monitor File System Activity
# Watch for file creation/modification
inotifywait -m -r /tmp /home 2>/dev/null &
./suspicious_binary
Capturing Network Traffic
Even in an isolated network, malware will attempt connections. Capture this for analysis:
# In the container
tcpdump -i any -w /output/traffic.pcap &
# Run the sample
./suspicious_binary
# Analyze
tcpdump -r /output/traffic.pcap -n
Automated Analysis Script
Here’s a script to automate basic analysis:
#!/bin/bash
# analyze.sh - Automated malware triage
SAMPLE="$1"
OUTPUT_DIR="/output/$(date +%Y%m%d_%H%M%S)"
mkdir -p "$OUTPUT_DIR"
echo "[*] Analyzing: $SAMPLE"
echo "[*] Output: $OUTPUT_DIR"
# Static analysis
echo "[+] File type..."
file "$SAMPLE" > "$OUTPUT_DIR/filetype.txt"
echo "[+] Hashes..."
md5sum "$SAMPLE" > "$OUTPUT_DIR/hashes.txt"
sha256sum "$SAMPLE" >> "$OUTPUT_DIR/hashes.txt"
echo "[+] Strings..."
strings "$SAMPLE" > "$OUTPUT_DIR/strings.txt"
echo "[+] Headers..."
readelf -h "$SAMPLE" > "$OUTPUT_DIR/headers.txt" 2>/dev/null
echo "[+] Sections..."
readelf -S "$SAMPLE" > "$OUTPUT_DIR/sections.txt" 2>/dev/null
# Extract IOCs
echo "[+] Extracting IOCs..."
grep -oE "(http|https|ftp)://[^\"\' ]+" "$OUTPUT_DIR/strings.txt" > "$OUTPUT_DIR/urls.txt"
grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" "$OUTPUT_DIR/strings.txt" > "$OUTPUT_DIR/ips.txt"
echo "[*] Analysis complete: $OUTPUT_DIR"
Cleanup and Forensics
After analysis, always clean up properly:
# Stop and remove container
docker stop malware-analysis
# Remove the image if contaminated
docker rmi malware-sandbox
# Prune everything
docker system prune -af --volumes
Best Practices Summary
- Never use
--privileged- This defeats all isolation - Always use
--network noneor--internal- Prevent C2 communication - Drop all capabilities - Minimal permissions
- Use read-only filesystems - Prevent persistence
- Set resource limits - Prevent resource exhaustion
- Run as non-root - Additional isolation layer
- Destroy after use - Use
--rmflag always
When NOT to Use Docker
Docker is not suitable for:
- Kernel exploits or rootkits
- Hypervisor escape attempts
- Container escape exploits
- Advanced persistent threats (APTs)
For these, use nested VMs with snapshots on an air-gapped analysis machine.
Conclusion
Docker provides a quick and effective way to safely triage malware samples when used correctly. The key is layering multiple security controls: network isolation, capability dropping, resource limits, and read-only filesystems. Remember—Docker isolation is not perfect, but with proper configuration, it’s suitable for most day-to-day malware analysis tasks.
Stay safe, and happy hunting! 🔍