drop lxc/lxd storage pool · parse container snapshots + config · timeline + findings · runs locally
flags raw disk devices · privileged=true · snapshot rollback abuse · host path mounts · raw.lxc overrides
heuristic screener · lxd config format varies by distro/version · parses artifacts locally · not definitive proof