I created ContainerSSH[1] in 2020 which is an SSH server that drops you in a container instead of launching a shell directly. (It's not a containerized SSH, it talks to the Docker/Kubernetes API.) It has since become a CNCF Sandbox project The main use case is creating jump servers and remote dev environments, but it can also be used as a honeypot due to its audit log features that allow you to reconstruct the SSH interaction accurately. We did a few demos where we showed the SSH interactions on a honeypot in real time on a web interface. The authentication and dynamic configuration of containers is done via webhooks.

A now-comaintainer from CERN also contributed X11 and port forwarding support to it and is now continuing the development of the project. Since I switched industries and am nowhere near containers anymore, the project could really use a few contributors.

A few feature ideas we had but never implemented:

- Web-based terminal that directly interacts with ContainerSSH via websockets.

- File manager using the same.

- Better audit logging for SFTP interactions, allowing for filename-based search.

- Web interface for viewing audit logs.

There are a few talks/videos available online:

- ContainerSSH in one minute [2]

- Building a science lab with ContainerSSH (CERN usecase, Red Hat Research Day EU 2022) [3]

- Build your own honeypot with ContainerSSH (DevConf CZ 2021) [4]

[1]: https://containerssh.io

[2]: https://www.youtube.com/watch?v=Cs9OrnPi2IM

[3]: https://www.youtube.com/watch?v=g7M7japaa1o

[4]: https://www.youtube.com/watch?v=aqJpsx7HpkU