I did a docker pull and can list the image that's downloaded. I want to see the contents of this image. Did a search on the net but no straight answer.
-
3Possible duplicate of Exploring Docker container's file system – Vadzim Nov 4 '18 at 23:36
-
23Not a dupe. Viewing the container and the image are not the same thing. You may want to view the initial filesystem or even validate that there is nothing malicious inside the image before it gets a chance to run. – Keilaron Feb 26 '19 at 18:05
-
5if you could not run the image as container you can use a tool like drive (github.com/wagoodman/dive) or you can use docker save to export the image as tar file. Then you can explore the tar or with dive you can asap explore the image. – Huluvu424242 Mar 13 '19 at 22:57
-
Not a dupe but you can find the answer here: stackoverflow.com/a/40324326/5641227 – Khalil Gharbaoui Oct 6 '19 at 9:33
You can just run an interactive shell container using that image and explore whatever content that image has.
For instance:
docker run -it image_name sh
Or following for images with an entrypoint
docker run -it --entrypoint sh image_name
Or, if you want to see how the image was build, meaning the steps in its Dockerfile
, you can:
docker image history --no-trunc image_name > image_history
The steps will be logged into the image_history
file.
-
1Thanks. First one is what I am looking for. Basically explore the folders. – pylearn Jun 27 '17 at 3:14
-
24I'm trying to see the contents of an image that is created using "FROM scratch" and there is no shell available. Is there any other way to see the contents? The image I'm trying to see is portainer/portainer. – Juan Hernandez Nov 30 '17 at 10:21
-
2Is it possible that someone see the contents of the image without spawning a container? Or can we assume that it is safe from all unless they have rights to spawn a container from it? – Shabirmean Dec 30 '17 at 21:03
-
3combining what's told before "for a windows container with entrypoint":
docker run -it --entrypoint cmd <image_name>
will work. – Beytan Kurt Nov 1 '18 at 15:41 -
4@JuanHernandez, yes, you can dump the full contents of the image as indicated in stackoverflow.com/a/42677219/320594. – Jaime Hablutzel Nov 24 '18 at 22:35
The accepted answer here is problematic, because there is no guarantee that an image will have any sort of interactive shell. For example, the drone/drone image contains on a single command /drone
, and it has an ENTRYPOINT
as well, so this will fail:
$ docker run -it drone/drone sh
FATA[0000] DRONE_HOST is not properly configured
And this will fail:
$ docker run --rm -it --entrypoint sh drone/drone
docker: Error response from daemon: oci runtime error: container_linux.go:247: starting container process caused "exec: \"sh\": executable file not found in $PATH".
This is not an uncommon configuration; many minimal images contain only the binaries necessary to support the target service. Fortunately, there are mechanisms for exploring an image filesystem that do not depend on the contents of the image. The easiest is probably the docker export
command, which will export a container filesystem as a tar archive. So, start a container (it does not matter if it fails or not):
$ docker run -it drone/drone sh
FATA[0000] DRONE_HOST is not properly configured
Then use docker export
to export the filesystem to tar
:
$ docker export $(docker ps -lq) | tar tf -
The docker ps -lq
there means "give me the id of the most recent docker container". You could replace that with an explicit container name or id.
-
1You can also use the out parameter as in
docker export $(docker ps -lq) -o foo.tar
– Liam Dec 7 '20 at 12:56
You should not start a container just to see the image contents. For instance, you might want to look for malicious content, not run it. Use "create" instead of "run";
docker create --name="tmp_$$" image:tag
docker export tmp_$$ | tar t
docker rm tmp_$$
-
18The 2nd line above just lists the file-system content. If you want to get all the files as a tar you can replace it with something like
docker export tmp_$$ > image-fs.tar
. – Pino Jul 5 '19 at 10:29 -
1What will be the 2nd line for Windows OS? The
docker export tmp_$$ | tar t
will not work. – Nairum Aug 29 '19 at 10:38 -
2
-
3@AlexeiMarinichenko you can use the
-o
parameter to specify the file to write to. E.g.docker export -o c:\temp\tmp_$$.tar tmp_$$
. – John Mills Oct 16 '19 at 21:27 -
1The docker create command errors for me with a
No command specified
. putting a dummy command likels
at the end (even if the command would fail if the container were started) seems to work.docker create --name="tmp_$$" image:tag ls
– pabo Sep 2 '20 at 17:10
docker save nginx > nginx.tar
tar -xvf nginx.tar
Following files are present:
- manifest.json – Describes filesystem layers and name of json file that has the Container properties.
- .json – Container properties
- – Each “layerid” directory contains json file describing layer property and filesystem associated with that layer. Docker stores Container images as layers to optimize storage space by reusing layers across images.
https://sreeninet.wordpress.com/2016/06/11/looking-inside-container-images/
OR
you can use dive to view the image content interactively with TUI
-
7This seems like the most useful answer to me, as you don't have to start a container to get the files. – Alec Thomas Feb 27 '19 at 0:14
-
1Absolutely agree @AlecThomas - and to take it a step further, why do I even need
docker
just to see the contents of what is, essentially, just a different type of archive file. – Ed Randall Mar 17 '19 at 10:54 -
1good answer, I would also specify the tag:
docker save --output nginx.tar nginx:latest
, otherwise, according to the doc, it will contain "all parent layers, and all tags + versions" – Tarek Jul 16 '19 at 17:33 -
1This should be upvoted as this is probably the only way to explore internals if you don't have any of Unix utils inside. Also this way doesn't require the creation of a container. – Stanislav German-Evtushenko Jul 19 '19 at 9:08
EXPLORING DOCKER IMAGE!
- Figure out what kind of shell is in there
bash
orsh
...
Inspect the image first: docker inspect name-of-container-or-image
Look for entrypoint
or cmd
in the JSON return.
- Then do:
docker run --rm -it --entrypoint=/bin/bash name-of-image
once inside do: ls -lsa
or any other shell command like: cd ..
The -it
stands for interactive... and TTY. The --rm
stands for remove container after run.
If there are no common tools like ls
or bash
present and you have access to the Dockerfile
simple add the common tool as a layer.
example (alpine Linux):
RUN apk add --no-cache bash
And when you don't have access to the Dockerfile
then just copy/extract the files from a newly created container and look through them:
docker create <image> # returns container ID the container is never started.
docker cp <container ID>:<source_path> <destination_path>
docker rm <container ID>
cd <destination_path> && ls -lsah
-
4The problem with this answer is that, as discussed in the accepted answer, there's no guarantee that your image has any shell in it. Or
ls
. Or really any common tools at all. – larsks Jan 7 '20 at 17:31 -
Yes, this assumes common tools are in there. You could of course always add a shell if you are allowed to ill add that layer to the answer and explain how to extract the files otherwise. – Khalil Gharbaoui Nov 5 '20 at 0:57
To list the detailed content of an image you have to run docker run --rm image/name ls -alR
where --rm
means remove as soon as exits form a container.
-
14
We can try a simpler one as follows:
docker image inspect image_id
This worked in Docker version:
DockerVersion": "18.05.0-ce"
-
15This doesn't show the contents; it only shows the layers, etc., that went into building the image. – Roger Lipscombe Jan 4 '19 at 14:22
There is a free open source tool called Anchore that you can use to scan container images. This command will allow you to list all files in a container image
anchore-cli image content myrepo/app:latest files
With Docker EE for Windows (17.06.2-ee-6 on Hyper-V Server 2016) all contents of Windows Containers can be examined at C:\ProgramData\docker\windowsfilter\
path of the host OS.
No special mounting needed.
Folder prefix can be found by container id from docker ps -a
output.