挖矿病毒kdevtmpfsi,kinsing进程

[youyanghust]

[youyanghust]

docker pull php:5.6-fpm from https://hub.docker.com

[LaurentGoderre]

www-data is a mounted volume so it probably is on your host, not in the image. What is the digest of the image you are using?

% docker images --filter "reference=php"
REPOSITORY   TAG       IMAGE ID       CREATED       SIZE
php          8.3-cli   9958ea8d36d3   2 weeks ago   530MB
php          5.6-fpm   3c6e97923edb   5 years ago   305MB

% docker inspect 3c6e97923edb
[
    {
        "Id": "sha256:3c6e97923edb4ec415e2bfe62eea8eb59d90e9a65fafc5c3276274e4ef04ae9f",
        "RepoTags": [
            "php:5.6-fpm"
        ],
        "RepoDigests": [
            "php@sha256:4f070f1b7b93cc5ab364839b79a5b26f38d5f89461f7bc0cd4bab4a3ad7d67d7".  <-- This one
        ],
...

[tianon]

See also #1110 and #1127

[youyanghust]

close php-fpm 9000 port in firewall