Closed
Description
Description of the bug:
I found my VM is running high cpu with tmp/kdevtmpfsi after setting up a docker compose running this project.
sudo kill -9 $(pidof kdevtmpfsi) # Primary miner[4][8]
sudo kill -9 $(pidof kinsing) # Watchdog process[4][7]
sudo find / -iname kdevtmpfsi* -exec rm -fv {} \; 2>/dev/null
sudo find / -iname kinsing* -exec rm -fv {} \; 2>/dev/null
sudo rm -f /etc/ld.so.preload # Common persistence file[3][7]
removed '/var/lib/docker/overlay2/0b1641491966b2e659e05fed665bbd12dff7fe05cc4d84da44efc72fc0d678ca/diff/tmp/kinsing'
The fix is based on https://stackoverflow.com/questions/60151640/kdevtmpfsi-using-the-entire-cpu
But it's quite concerning why this OSS project can introduce crypto-mining. https://www.reddit.com/r/docker/comments/k2lwvd/protect_your_docker_containers_from_kinsing/ could be related.
Actual vs expected behavior:
No response
Any other information you'd like to share?
No response
Metadata
Metadata
Assignees
Labels
No labels