Indeed. OP's investigation proves nothing other their device / system was compromised and provides 0 evidence the container itself is the issue.

The comment was 100% in jest / sarcasm.

OP's system got compromised at some point; the images are clean.

Hell if he didn't want to post his clickbait he easily could have verified with a clean image on a known clean system

Brand new account, 7 different comments on this post, all aggressively trying to discredit it.

A bit suspicious, don't you think?

It’s a fair observation.

Their comments are extremely high confidence (failing to recognize that accidents and supply chain attacks do sometimes happen) and because they are new and posting frequently in the same thread, their account shows the signs of a bot/disinfo campaign (which does happen on HN).

It's a completely useless observation. Doesn't add anything productive to the topic.

It's not useless, a new account commenting what amounts to "There's nothing wrong, stop looking", multiple times, is the opposite of assuring.

no one said stop looking; simply that OP was wildly misinformed and he proved nothing of any value

You can back up a debunking with receipts or reputation. Ideally, both.

You and anotherlogin448 have neither, but also show incredible aggression towards anyone pointing that out.

Your confidence might actually be warranted, but there's no reason for any one of us to take you on your word, and neither of you have given anything else.

> I had to create this account just to answer you—is that suspicious too?

No, but if you were to make 6 more comments under the same post all saying the same thing in an overly confident and aggressive tone, it would be.

And yet, I probably would have done that if he hadn't done it first. Your incitement to suspicion is highly biased and also an ad hominem diversion.

There's no actual issue.

OP's system got compromised.

OP got compromised there's no issue in any hotio container.

Code and CI is all open source.

My money is on the author had not updated their docker image version/tag in over 2 years.

It looks like the app used weak hard-coded admin credentials back then. Appears to have been fixed in 2023.

I am running, ghcr.io/hotio/qbittorrent:release-5.1.1

qBittorrent put out version 5.1.2 over 2 months ago:

  > Wed Jul 02nd 2025 - qBittorrent v5.1.2 release
  > [...]
  > qBittorrent v5.1.2 was released.
  > SECURITY: It contains security fixes for the WebAPI, Rss and Search modules.

I never have exposed this container to the world ever, and my server do report the existence of such binary. That is the reason based on CPU usage I suspect that mining never triggered.

> ps -ef | grep netservlet > root 3708105 3665360 0 08:06 pts/2 00:00:00 grep netservlet

Edit: absolutely make sure you are running the newest version of the image. It patches security issues in the app.

Read this article:

https://torrentfreak.com/qbittorrent-web-ui-exploited-to-min...

It mentions the app will use uPnP to expose itself automatically.

Remember that BitTorrent protocol is P2P, so it likely is accessible from the internet.

My suggestion is to wipe the image, update pull/run the newest version, and change the admin credentials after it starts up.

that's just grep showing you your own grep process lol. you can do ps -ef | grep foobarbaroof and get the same thing...

Damn it!! Yeah, morning bran without coffee! Thank you for pointing it out.

My bad.

You can use pgrep to avoid this.

How long have you been running this container?

Can you check the contents of your qBittorrent.conf?

And yet everything is open source and easily auditable. Most likely OP got pwnd and clearly is unable to understand sarcasm.

You all really think that hotio snuck a crypto miner in somehow with all clearly open source code - and not a single person but OP noticed for years?

With the SSH/NPM supply chain attack, we all live in fear now. It just need one very smart person to deploy such hack. I'm not saying hotio did something, all I am saying that with new information, we all should check our deployment. Along with OP I'm affected, where I never have exposed the docker to world ever.

So we should not deny the possibility of something off here.

You aren’t affected though… the output you posted clearly shows the only response to that process grep was your own grep…