This will cover what Docker is, what containers are, and why they are extremely useful in supporting incident handling and incident response activities. A base laptop with no installed security tools will be used for malware analysis. This will show the benefits of using containerized versions of security tools to support incident response and incident handling. Incident Response tools are usually built, deployed and maintained before there is an incident. A considerable amount of effort can be spent in maintaining dozens of laptops with all the tools a team may need in DFIR/IH. Too often it is discovered during an event that tools have stopped working. Kernel and Library updates can cause tools to fail when needed most. Systems updates, and inconsistent package updates can cause a team to have several different versions of the same tool running. Dockerized applications can be spun up extremely quickly. There is no lengthy install or configuration effort needed, meaning equipment can be swapped on the fly. When updated security tools come out, all analyst get access to the tools at the same time. This ease and quickness allows great flexibility in minimizing failures due to system updates, equipment failures, and even analyst skill gaps.