works

app/sbin/audit

@@ -41,7 +41,6 @@ def main():
 
     # Container identity
     audit["container_id"] = os.environ.get("HOSTNAME")
-    audit["environment"] = dict(os.environ)
 
     # OS information inside container
     audit["os_release"] = read_file("/etc/os-release")
@@ -52,9 +51,7 @@ def main():
 
     if os.path.exists("/etc/alpine-release"):
         audit["packages"]["manager"] = "apk"
-        audit["packages"]["installed"] = cmd(
-            ["apk", "info", "-v"]
-        ).splitlines()
+        audit["packages"]["installed"] = cmd(["apk", "info", "-v"]).splitlines()
         audit["packages"]["upgradeable"] = cmd(
             ["apk", "version", "-l", "<"]
         ).splitlines()
@@ -67,9 +64,7 @@ def main():
 
     elif os.path.exists("/etc/redhat-release"):
         audit["packages"]["manager"] = "rpm"
-        audit["packages"]["installed"] = cmd(
-            ["rpm", "-qa"]
-        ).splitlines()
+        audit["packages"]["installed"] = cmd(["rpm", "-qa"]).splitlines()
 
     # Docker engine information
     audit["docker_version"] = cmd(
@@ -132,15 +127,14 @@ def main():
     audit["docker_logs"] = logs
 
     # SSH config if present
-    audit["sshd_config"] = cmd(
-        ["sshd", "-T"]
-    ).splitlines()
+    audit["sshd_config"] = cmd(["sshd", "-T"]).splitlines()
 
     # Users
     audit["passwd"] = read_file("/etc/passwd")
 
     # Runtime info
     audit["uptime"] = cmd(["uptime"])
+    audit["top"] = cmd(["top", "-b", "-n", "1"]).splitlines()
 
     # cgroups (useful in Docker)
     audit["cgroup"] = read_file("/proc/self/cgroup")