sameersbn / sameersbn/docker-gitlab
Is this a hack attempt?
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 8.1k
- Forks
- 2.1k
- Avg merge
- 17h 47m
- Merged PRs (30d)
- 7
Description
We have received a call from the server security team.
A large amount of traffic is occurring with Chinese IP.
I immediately connected to the server and checked.
The "diofiglos" process was running.
Network traffic is 500 Mbps/s
99% CPU Usage
I went into the "sameersbn/gitlab:12.9.2" container and checked it.
I typed the top command
The "diofiglos" process is running.
I run the "docker-compose down" command.
The "diofiglos" process is kill.
What is this?
Does anyone have the same symptoms?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the docker-compose configuration and the sameersbn/gitlab:12.9.2 container, then inspect the running container with top and its network activity as described. Determine whether the diofiglos process originates from the image or deployment and document evidence that distinguishes expected behavior from a compromise.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, docker-compose, shell
- Domain
- devops, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 15/100