Freeze the compromised box, hand forensics a copy

11:20 AM. The intranet wiki container is making outbound connections it has no reason to make.

You snapshot it first. The snapshot captures the whole disk as it is: the new cron entry, the modified binary, the shell history, whatever was dropped in /tmp. Then you restore last night's snapshot. The wiki is clean and serving in under a minute.

The compromised state is not gone. POST /api/v1/containers/{id}/copy with source_snapshot creates a new container holding exactly that frozen disk. Set its network to block, give the security team the terminal URL, and they can walk through the attacker's work at leisure while production keeps running. When the report is written, delete the copy and the snapshot.

On a VM you chose: keep the evidence and stay down, or wipe it and come back.

Evidence and uptime used to be a trade. Now they're two API calls.