The comment was 100% in jest / sarcasm.

OP's system got compromised at some point; the images are clean.

Hell if he didn't want to post his clickbait he easily could have verified with a clean image on a known clean system

Currently, on my own system, the docker container of qBitTorrent definitely doesn't seem to use more resources than it should.

Lack of a tagged stable/release version with libtorrent 2.0 for one.

For clarity: The post is about a server running a 3rd party docker image of qbittorrent.

But there’s no evidence presented that it was hotio’s docker image on GCHR which was compromised, and there is reason to believe it might be an older, vulnerable version of qbittorrent in the docker image which was compromised.

The vulnerability: (credit crtasm)

https://torrentfreak.com/qbittorrent-web-ui-exploited-to-min...

Finally made an account on hackernews for this after years of reading. I just checked my Unraid server, I'm running five docker containers from Hotio - Prowlarr, Sonarr, Radarr, Overseerr, and Tautulli. If I remember correctly, I originally chose Hotio's configs due to there being a few extra settings missing from the standard images in the Unraid store. This was all to avoid learning anything about docker at the time, but since then I've gained a few skills so I'd say it's time for me to set up the containers myself. Thanks for posting this, I really only read HN so I would have missed this if it were anywhere else.

Alot around the ARR stack which makes it likely to be used by many less knowledgeable users. Nice Grift.

edit: it seems consensus in the thread that OP was pwned and the docker images are clean. Please accept my apologies hotio.

And that also goes to show how hilariously wrong OP is.

His system was compromised - hotio's containers are all clean

Indeed. OP's investigation proves nothing other their device / system was compromised and provides 0 evidence the container itself is the issue.

In my case, web UI was behind qbittorrent auth + authelia, haven't seen suspected logs that would trace it back to that, really interesting though!

With the SSH/NPM supply chain attack, we all live in fear now. It just need one very smart person to deploy such hack. I'm not saying hotio did something, all I am saying that with new information, we all should check our deployment. Along with OP I'm affected, where I never have exposed the docker to world ever.

So we should not deny the possibility of something off here.

Unironically this.

Monero is literally the only crypto that does what it says on the tin. Anonymous, decentralized, minable on commodity hardware. It basically solves internet micropayments.

If you run a website, instead of ads you could provide users with well-behaved "support this site by enabling cryptominer while browsing" toggle that defaults to off.

But no, that'd be "weird". Or in less gullible terms, it spooked some spooks (I mean in the Stirnerian sense, not the one the reader might be thinking of).

And, well, there you have it. 16 years after Satoshi people patting themselves on the shoulder, considering it a resounding success how BTC has become toothless enough for PayPal to adopt, ffs.

And as usual nobody putting 2 and 2 together till some hackers from some hellhole did.

And presumably some other big picture thinkers saw it, too, the ones in the opposite of a hellhole who poured literal billions to turn a global plea for financial liberty into the largest FUD cloud since the Halloween papers.

This output indicates the only process matching netservlet is your own grep, no?

OP got compromised there's no issue in any hotio container.

Code and CI is all open source.