docker container escapes, host compromised?

Hello friends, I need help to make a server up again. I found weird process in my VPS, something called "bh-agent" and "bh-monitor" running as root. I did not install this. I check with ps aux and see connections to IP I do not recognize. My first tought is docker container escape, maybe? I run some containers but I tought they are isolated. Can someone help me understand if host is compromised? I run Debian 12, Docker from official repo https://docs.docker.com. Regards.

Before you torch the entire box (which I have done. More than once). Let's look at the actual binary paths. Run `ls -la /proc/$(pidof bh-agent)/exe` and check if it resolves to something inside `/opt` or `/usr/local` rather than a Docker overlay. If it's a proper systemd service with a unit file, that's a clue. If it's running from `/tmp`, that's a different clue entirely. (I once nuked a server over a poorly named Nagios plugin. The shame still lingers.)

I had something similar last tuesday it was raining and I had just eaten a bagel with cream cheese and my cat was sitting on the keyboard as usual and I noticed this weird process called monitor-something and I panicked and started checking everything and I remembered I had installed a panel from the provider but I forgot about it and it turned out to be their thing and I felt stupid but also angry because why would they name it something so scary and my cat knocked over my coffee when I screamed and the weather was terrible all week and I had to clean the keyboard and you should check if your provider installed anything without telling you because mine does that all the time and never documents it and I wrote them an angry ticket and they said "it is in the welcome email" which I deleted obviously who keeps those and anyway check your email or ticket them first before you assume the worst

Right then, "bh-agent" rings a bell proper — that's our old monitoring stack at Hostinger (I work there, full disclosure ). We bungled the naming something fierce and the docs were, well, let's call them "aspirational." It's meant to check if your node is on fire, not set it on fire. Should be in `/opt/badger/` with a config you can read. If it's elsewhere, then panic away, cheers lads.

I had same problem before, I tought my server is hacked, I was very scared. I check and it is just monitoring agent from provider, they put it without tell us. I write ticket and they say "is normal". Very nice. But I was angry too. You should check /opt/badger/ or maybe /var/lib/bh/ and see if file is there. If yes then is not docker escape my friend. If not then maybe you have real problem. Good luck!