Docker Diffing for Terminal MCP Honeypot

Thu, 19 Feb 2026 00:00:00 +0000

Sooo, it was quite interesting to see that there is a docker diff command in the docker-py sdk. This immediately piqued my curiousity around the possible use-cases of the feature. One thought that immediately came to me was honeypots.

Honeypots

Honeypots - and honeytokens / canary tokens - are quite possibly the greatest ROI tool in the defensive cybersecurity realm. Their main goal is to capture attacker tradecraft and provide signals around trends in global security like data collected at scale by companies like GreyNoise. In comparison, honeytokens/ canary tokens (article from security engineering.dev) are used as an early detection mechanism that provide early alerts.

Docker with Python

Mon, 09 Feb 2026 00:00:00 +0000

Soooo, I have decided to write more about some of the things that I am doing right now.

Today I decided to port my janky subprocess.run(cmd) approach to managing docker containers to docker-py sdk.

Client

To interact with the local docker service, we first have to create a client.

The client can be created as:

import docker

client = docker.from_env()

There are other options available to for various configurations like providing the DOCKER_HOST argument for remote hosts but I’ll leave it to you for reading up on it from docker client ref.

Docker on Ashim Mahara

Docker Diffing for Terminal MCP Honeypot

Honeypots

Docker with Python

Client