Tiny reminder to check your resource usage and update containers often
So today I noticed my NUC was maxed out at 100% CPU. Turns out it had been infected with xmrig. After digging around, I found it tucked away in a containerd snapshot:
`/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/1704/fs/root/moneroocean/xmrig`
I traced it back to a Langflow container, the /app/langflow directory was in the same snapshot layer.
The good news for me: it was fully contained inside the container. A reboot completely killed it.
In the snapshot I could see some references to their address, there are still 44 more infected:
https://moneroocean.stream/#/dashboard?addr=86CBz3FgpRq3ETNpf5fbL8Jz8vsvFTwxUiBR7o3Xs5Zm2XtMr1QFgr4SpUwHduidE6jab5ifkZSYwASg4wvyXbQbSscsUzQ
Posted Feb 15, 2026, 10:51 PM UTC
26151