r/selfhosted•
darkshifty

Tiny reminder to check your resource usage and update containers often

Wiki's

So today I noticed my NUC was maxed out at 100% CPU. Turns out it had been infected with xmrig. After digging around, I found it tucked away in a containerd snapshot:

`/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1704/fs/root/moneroocean/xmrig`

I traced it back to a Langflow container, the /app/langflow directory was in the same snapshot layer.

The good news for me: it was fully contained inside the container. A reboot completely killed it.

In the snapshot I could see some references to their address, there are still 44 more infected:
https://moneroocean.stream/#/dashboard?addr=86CBz3FgpRq3ETNpf5fbL8Jz8vsvFTwxUiBR7o3Xs5Zm2XtMr1QFgr4SpUwHduidE6jab5ifkZSYwASg4wvyXbQbSscsUzQ

Posted Feb 15, 2026, 10:51 PM UTC

26151
Loading comments…