floci

This Compose file configures an OCI emulator and an example app, with no observed malware or credential theft behavior. Its main security concern is the Docker socket mount, which grants the emulator extensive control over the host Docker daemon and is described as necessary for launching child containers. The image uses the mutable floci/floci-oci:latest tag; the emulator endpoint is published only on 127[.]0[.]0[.]1:4599. Overall severity is a configuration-level security warning rather than evidence of malicious behavior.

This Compose file configures a local GCP emulator and example app, with the emulator port restricted to host loopback and no apparent credential theft or malicious network behavior. The significant security concern is mounting /var/run/docker.sock into the emulator, which grants access to the host Docker daemon and can have host-level impact if the container or image is compromised; the mutable latest image tag also reduces version reproducibility. Severity is a security warning dependent on trusting and pinning the image, rather than evidence of malware.