·5 min read
When a Security Alert Sent Me Down the Docker Rabbit Hole
SentinelOne flagged pam_exec.so on a CI/CD runner — under /var/lib/docker/overlay2. Tracing it from file to layer to image turned a scary alert into a lesson in how Docker actually stores things, and in provenance.