Source: https://www.slideshare.net/JoelLathrop2/docker-forensics Once LVM has settled: ``` cont_id="whatevs" m=$(cat /var/lib/docker/image/devicemapper/layerdb/mounts/$cont_id/mount-id) $d=$(jq ".device_id" /var/lib/docker/devicemapper/metadata/$m) $size=$(jq ".size" /var/lib/docker/devicemapper/metadata/$m) dmsetup create thin-$cont_id --table "0 $s thin /dev/mapper/docker-thinpool $d" mount -o ro,nouuid /dev/mapper/thin-$cont_id /mnt/$cont_id/ ```
Source:
https://www.slideshare.net/JoelLathrop2/docker-forensics
Once LVM has settled: