<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Container Incident Response — API Reference

## kubectl Commands

### Pod Investigation

```bash
# List pods with restart counts
kubectl get pods -A --sort-by='.status.containerStatuses[0].restartCount'

# Get pod details
kubectl describe pod -n $NS $POD

# Exec into container
kubectl exec -it -n $NS $POD -- /bin/sh

# Get pod logs
kubectl logs -n $NS $POD --all-containers --timestamps
```

### Evidence Collection

```bash
# Running processes
kubectl exec -n $NS $POD -- ps auxf

# Network state
kubectl exec -n $NS $POD -- ss -tulnp
kubectl exec -n $NS $POD -- cat /proc/net/tcp

# Environment variables
kubectl exec -n $NS $POD -- env
```

### Containment

```bash
# Apply isolating NetworkPolicy
kubectl apply -f network-policy-deny-all.yaml

# Cordon node
kubectl cordon $NODE

# Label for tracking
kubectl label pod -n $NS $POD incident=INC-2026-0342
```

## Docker Commands

```bash
# Container filesystem diff
docker diff $CONTAINER_ID

# Export container filesystem
docker export $CONTAINER_ID > container.tar

# Image layer history
docker history --no-trunc $IMAGE:$TAG

# Inspect container
docker inspect $CONTAINER_ID
```

## Trivy Image Scanning

```bash
# Scan for HIGH/CRITICAL CVEs
trivy image --severity HIGH,CRITICAL $IMAGE:$TAG

# JSON output for automation
trivy image --format json --severity HIGH,CRITICAL $IMAGE:$TAG

# Scan filesystem (exported container)
trivy fs --severity HIGH,CRITICAL /evidence/container_fs/
```

## Falco Runtime Events

```bash
# Stream Falco alerts
kubectl logs -n falco -l app.kubernetes.io/name=falco -f

# Filter critical events
kubectl logs -n falco -l app.kubernetes.io/name=falco | grep "Critical"
```

## Key Parameters

| Parameter | Description | Example |
|-----------|-------------|---------|
| `-n` | Kubernetes namespace | `production` |
| `--all-containers` | Include all containers in pod | N/A |
| `--severity` | Trivy vulnerability severity filter | `HIGH,CRITICAL` |
| `--format json` | Machine-readable output | N/A |
| `--field-selector` | Filter events by field | `involvedObject.name=pod` |
