skills.rest
chengzongcai
chengzongcaiCOMMUNITY
Explore all skills by this author →
GitHub

competition-container-runtime

Diagnose live container runtime deviations from checked-in manifests in CTF sandboxes.

21|8|Updated Aug 3, 2026
Search Tags:#kubernetes#docker compose#ctf#sidecar#container runtime#sandbox analysis#mounted secrets
One-click install
npx skills add https://github.com/chengzongcai/reverse-skill-backup --skill competition-container-runtime-chengzongcai
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: competition-container-runtime
Source: https://github.com/chengzongcai/reverse-skill-backup/tree/main/CTF-Sandbox-Orchestrator/competition-container-runtime
Command: npx skills add https://github.com/chengzongcai/reverse-skill-backup --skill competition-container-runtime-chengzongcai

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? In CTF sandbox challenges, the live container or pod often behaves differently from what the checked-in compose or Kubernetes manifests claim, and this Skill helps you trace mounted secrets, sidecars, init containers, and runtime routes to find where reality diverges from intent. ## Core Features & Use Cases - Live Runtime Mapping: Compare manifests against running containers, pods, mounted volumes, environment variables, sidecars, and entrypoints to identify which process actually consumes injected state. - Route and Mount Tracing: Map virtual hosts, reverse proxies, services, container ports, and filesystem mounts together to prove a minimal live path from mounted state to reachable behavior. - Deviation Reporting: Pinpoint the earliest point where the live runtime diverges from checked-in intent with a compact evidence chain. - Use Case: A CTF challenge mounts a secret into a shared volume that only a sidecar renders into config consumed by the main container; this Skill guides you to trace that chain and reach the runtime-only exposed route. ## Quick Start After the ctf-sandbox-orchestrator skill is active, ask it to explain why the live container differs from the manifests and where the mounted secret is actually consumed.

Frequently Asked Questions about competition-container-runtime

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find why a live container differs from its manifest?▼

Compare compose or Kubernetes manifests side by side with running containers, mounted volumes, environment variables, sidecars, and init containers. Identify which process actually consumes the mounted secret or rendered config, then record the earliest divergence point.

How do I trace a mounted secret to the process that consumes it?▼

Trace the mount chain by identifying who writes the file, where it is mounted, which process reads it, and which route or behavior depends on it. Keep secrets, rendered config, and sidecar output separate from static manifests during analysis.

When should I use container runtime analysis versus Kubernetes control-plane analysis?▼

Use container runtime analysis when the challenge concerns live mounts, sidecars, or entrypoint drift. If the hard part is kube API permissions, RBAC edges, admission mutations, or controller-created workload drift, use the Kubernetes control-plane skill instead.

Why does a route only become reachable after container startup?▼

Some paths are exposed only at runtime because reverse-proxy routing, sidecar-generated config, or init container output creates them after startup. Checked-in manifests alone will not show these runtime-only routes, so live inspection is required.

What are common pitfalls in live container analysis?▼

Common pitfalls include treating checked-in manifests as deployment truth, stopping at confirming a secret is mounted without proving the consuming process, and missing sidecar or init container output because only the main service was inspected.

Related Skills

Explore More Software Engineering Skills→
xjtu-wangxjtu-wang
4

competition-custom-protocol-replay

Recover and replay custom binary or text protocols to verify stateful acceptance.

Community
Advanced
xjtu-wangxjtu-wang
4

competition-kernel-container-escape

Prove container-to-host boundary-crossing primitives during security assessments.

Community
Advanced
xjtu-wangxjtu-wang
4

competition-k8s-control-plane

Trace Kubernetes API paths, RBAC edges, and admission mutations to workload exposure.

Community
Advanced
CloudyWingCloudyWing

docker

Optimize Dockerfiles and Compose files for secure, cache-friendly images.

Community
Intermediate