Docker Remote Api Container Creation Sequence

Identifies a coordinated interaction with the Docker Remote API where an actor issues HTTP GET and POST requests culminating in container creation. This pattern is consistent with automated abuse of an exposed Docker daemon (typically unauthenticated on TCP/2375), where the attacker probes the API and then programmatically creates a container for code execution or persistence.