Home / server / Questions / 803092
Accepted
haemse
Asked: 2016-09-15 11:22:14 +0800 CST

WP in docker container hacked - Server sends Phishing mails - disable container from other OS with the server volume mounted?

  • 772

Wordpress that has not been updated in a docker container on a vServer has probably been hacked since the provider notified me about the server sending phishing mails and deactivated my machine.

Now they let me run a rescue linux from where I can mount the former server SSD. Can anyone tell me how to prevent the specific container from running when the original OS is powered up again? Cause obviously I can't call the docker daemon to set any parameters ...

linux docker phishing linux-vserver

1 Answers

  1. Best Answer

    The manual solution would be to delete or move /var/lib/docker/containers. Inside of each sub-folder will be a config.v2.json and hostconfig.json which you may be able adjust by hand, particularly the entry in hostconfig.json for:

    "RestartPolicy":{"Name":"always","MaximumRetryCount":0}

    which you can try changing to:

    "RestartPolicy":{"Name":"","MaximumRetryCount":0}

    You can also simply disable the Docker service, depending on how that is launched.

    • 1