969

I did a docker pull and can list the image that's downloaded. I want to see the contents of this image. Did a search on the net but no straight answer.

Improve this question
4
  • 5
    Possible duplicate of Exploring Docker container's file system Commented Nov 4, 2018 at 23:36
  • 93
    Not a dupe. Viewing the container and the image are not the same thing. You may want to view the initial filesystem or even validate that there is nothing malicious inside the image before it gets a chance to run. Commented Feb 26, 2019 at 18:05
  • 10
    if you could not run the image as container you can use a tool like drive (github.com/wagoodman/dive) or you can use docker save to export the image as tar file. Then you can explore the tar or with dive you can asap explore the image. Commented Mar 13, 2019 at 22:57
  • 1
    Not a dupe but you can find the answer here: stackoverflow.com/a/40324326/5641227 Commented Oct 6, 2019 at 9:33

17 Answers 17

Reset to default
1084

If the image contains a shell, you can run an interactive shell container using that image and explore whatever content that image has. If sh is not available, the busybox ash shell might be.

For instance:

docker run -it image_name sh

Or following for images with an entrypoint

docker run -it --entrypoint sh image_name

Or if you want to see how the image was built, meaning the steps in its Dockerfile, you can:

docker image history --no-trunc image_name > image_history

The steps will be logged into the image_history file.

Improve this answer
Sign up to request clarification or add additional context in comments.

12 Comments

I'm trying to see the contents of an image that is created using "FROM scratch" and there is no shell available. Is there any other way to see the contents? The image I'm trying to see is portainer/portainer.
Is it possible that someone see the contents of the image without spawning a container? Or can we assume that it is safe from all unless they have rights to spawn a container from it?
combining what's told before "for a windows container with entrypoint": docker run -it --entrypoint cmd <image_name> will work.
@JuanHernandez, yes, you can dump the full contents of the image as indicated in stackoverflow.com/a/42677219/320594.
This answer is not good because it depends on having a shell inside the image, which is not always the case. The docker create answer is the best one for the question if you're not interested in the examination of each image layer independently.
|
653
+50

You should not start a container just to see the image contents. For instance, you might want to look for malicious content, not run it. Use "create" instead of "run";

docker create --name="tmp_$$" image:tag
docker export tmp_$$ | tar t
docker rm tmp_$$
Improve this answer

14 Comments

The 2nd line above just lists the file-system content. If you want to get all the files as a tar you can replace it with something like docker export tmp_$$ > image-fs.tar.
What will be the 2nd line for Windows OS? The docker export tmp_$$ | tar t will not work.
This also works if there is no shell in the container
@AlexeiMarinichenko you can use the -o parameter to specify the file to write to. E.g. docker export -o c:\temp\tmp_$$.tar tmp_$$.
The docker create command errors for me with a No command specified. putting a dummy command like ls at the end (even if the command would fail if the container were started) seems to work. docker create --name="tmp_$$" image:tag ls
|
420

The accepted answer here is problematic, because there is no guarantee that an image will have any sort of interactive shell. For example, the drone/drone image contains on a single command /drone, and it has an ENTRYPOINT as well, so this will fail:

$ docker run -it drone/drone sh
FATA[0000] DRONE_HOST is not properly configured

And this will fail:

$ docker run --rm -it --entrypoint sh drone/drone
docker: Error response from daemon: oci runtime error: container_linux.go:247: starting container process caused "exec: \"sh\": executable file not found in $PATH".

This is not an uncommon configuration; many minimal images contain only the binaries necessary to support the target service. Fortunately, there are mechanisms for exploring an image filesystem that do not depend on the contents of the image. The easiest is probably the docker export command, which will export a container filesystem as a tar archive. So, start a container (it does not matter if it fails or not):

$ docker run -it drone/drone sh
FATA[0000] DRONE_HOST is not properly configured

Then use docker export to export the filesystem to tar:

$ docker export $(docker ps -lq) | tar tf -

The docker ps -lq there means "give me the id of the most recent docker container". You could replace that with an explicit container name or id.

Improve this answer

5 Comments

You can also use the out parameter as in docker export $(docker ps -lq) -o foo.tar
If you are like me, wondering what the - means in tar tf - : it's to tell tar that the "file" (f flag) to read is stdin
This should be the accepted answer. Although it should lead with the proper command.
This works on a container, not an image. Trivially fixed: docker image save $IMAGE | tar -tf -. The logic is the same: Docker needs to combine layers, higher-level layers can overwrite files from lower layers.
@MSalters even when running docker image save the output contains layer.tar files rather than the image contents directly, so I have to combine layers manually rather than have Docker do it.
279 
docker save nginx > nginx.tar
tar -xvf nginx.tar

Following files are present:

  • manifest.json – Describes filesystem layers and name of json file that has the Container properties.
  • .json – Container properties
  • – Each “layerid” directory contains json file describing layer property and filesystem associated with that layer. Docker stores Container images as layers to optimize storage space by reusing layers across images.

https://sreeninet.wordpress.com/2016/06/11/looking-inside-container-images/

OR

you can use dive to view the image content interactively with TUI

enter image description here

https://github.com/wagoodman/dive

Improve this answer

8 Comments

This seems like the most useful answer to me, as you don't have to start a container to get the files.
Absolutely agree @AlecThomas - and to take it a step further, why do I even need docker just to see the contents of what is, essentially, just a different type of archive file.
good answer, I would also specify the tag: docker save --output nginx.tar nginx:latest, otherwise, according to the doc, it will contain "all parent layers, and all tags + versions"
This should be upvoted as this is probably the only way to explore internals if you don't have any of Unix utils inside. Also this way doesn't require the creation of a container.
how did I survive without this tool in the last 5 years ?
|
45

EXPLORING DOCKER IMAGE!

  1. Figure out what kind of shell is in there bash or sh...

Inspect the image first: docker inspect name-of-container-or-image

Look for entrypoint or cmd in the JSON return.

  1. Then do: docker run --rm -it --entrypoint=/bin/bash name-of-image

once inside do: ls -lsa or any other shell command like: cd ..

The -it stands for interactive... and TTY. The --rm stands for remove container after run.

If there are no common tools like ls or bash present and you have access to the Dockerfile simple add the common tool as a layer.
example (alpine Linux):

RUN apk add --no-cache bash

And when you don't have access to the Dockerfile then just copy/extract the files from a newly created container and look through them:

docker create <image>  # returns container ID the container is never started.
docker cp <container ID>:<source_path> <destination_path>
docker rm <container ID>
cd <destination_path> && ls -lsah
Improve this answer

3 Comments

The problem with this answer is that, as discussed in the accepted answer, there's no guarantee that your image has any shell in it. Or ls. Or really any common tools at all.
Yes, this assumes common tools are in there. You could of course always add a shell if you are allowed to ill add that layer to the answer and explain how to extract the files otherwise.
docker cp <container ID>:<source_path> <destination_path> what do you mean by source path? as the assumption here is that we haven't run the container and do not know its full contents.
30

If you want to list the files in an image without starting a container :

docker create --name listfiles <image name>
docker export listfiles | tar -t
docker rm listfiles
Improve this answer

Comments

29

I tried this tool - https://github.com/wagoodman/dive I found it quite helpful to explore the content of the docker image.

enter image description here

Improve this answer

Comments

17

To list the detailed content of an image you have to run docker run --rm image/name ls -alR where --rm means remove as soon as exits form a container.

enter image description here

Improve this answer

1 Comment

This assumes that the image has ls available and in the PATH
8

It is commonly said you need to make a container from an image before you can export it, however there are other ways.

One of such ways is exporting the image using the build command.

By default the build command makes another image, which is not useful for us, instead, we can use the --output to specify that we want a folder or a .tar of the contents of the image:

echo 'from node:18-alpine' | docker build --output type=tar,dest=test-docker.tar -

You now get a tar file in the directory the docker build command is run, containing the exact file structure of your image, including the file owner information and original timestamps:

$ tar -tvf test-docker.tar | grep node | head
drwxr-sr-x 1000/1000         0 2024-03-16 04:31 home/node/
drwxr-xr-x 0/0               0 2024-03-16 04:32 tmp/v8-compile-cache-0/10.2.154.26-node.28/
-rw-r--r-- 0/0         2200240 2024-03-16 04:32 tmp/v8-compile-cache-0/10.2.154.26-node.28/zSoptzSyarn-v1.22.19zSbinzSyarn.js.BLOB
-rw-r--r-- 0/0              88 2024-03-16 04:32 tmp/v8-compile-cache-0/10.2.154.26-node.28/zSoptzSyarn-v1.22.19zSbinzSyarn.js.MAP
lrwxrwxrwx 0/0               0 2024-03-16 04:31 usr/local/bin/corepack -> ../lib/node_modules/corepack/dist/corepack.js
-rwxr-xr-x 0/0        94888944 2024-02-15 13:51 usr/local/bin/node
lrwxrwxrwx 0/0               0 2024-03-16 04:31 usr/local/bin/nodejs -> /usr/local/bin/node
lrwxrwxrwx 0/0               0 2024-03-16 04:31 usr/local/bin/npm -> ../lib/node_modules/npm/bin/npm-cli.js
lrwxrwxrwx 0/0               0 2024-03-16 04:31 usr/local/bin/npx -> ../lib/node_modules/npm/bin/npx-cli.js
drwxr-sr-x 0/0               0 2024-03-16 04:31 usr/local/include/node/
...
Improve this answer

1 Comment

I get some messages ending in 'successfully built abcde' but no output file is written.
5

Oneliner, no docker run (based on responses above)

IMAGE=your_image docker create --name filelist $IMAGE command && docker export filelist | tar tf - | tree --fromfile . && docker rm filelist

Same, but report tree structure to result.txt

IMAGE=your_image docker create --name filelist $IMAGE command && docker export filelist | tar tf - | tree --noreport --fromfile . | tee result.txt && docker rm filelist
Improve this answer

Comments

4

I usually do the following dirty way to get the contents.

  1. save the image

    docker save imagename > imagename.tar

  2. Open imagename.tar with any of the un archiving tools.

  3. Viola!!

Improve this answer

1 Comment

For me the resulting tar file doesn't contain the image's files directly, but several files abcde/layer.tar for different versions. A top level manifest.json tells you which is the latest version. I'd be interested to get the files for the current version directly.
2

if you want to check the image contents without running it you can do this:

$ sudo bash
...
$ cd /var/lib/docker  # default path in most installations
$ find . -iname a_file_inside_the_image.ext
... (will find the base path here)

This works fine with the current default BTRFS storage driver.

Improve this answer

Comments

1

Perhaps this is nota very straight forward approach but this one worked for me. I had an ECR Repo (Amazon Container Service Repository) whose code i wanted to see.

  1. First we need to save the repo you want to access as a tar file. In my case the command went like - docker save .dkr.ecr.us-east-1.amazonaws.com/<name_of_repo>:image-tag > saved-repo.tar
  2. UNTAR the file using the command - tar -xvf saved-repo.tar. You could see many folders and files
  3. Now try to find the file which contain the code you are looking for (if you know some part of the code) Command for searching the file - grep -iRl "string you want to search" ./

This will make you reach the file. It can happen that even that file is tarred, so untar it using the command mentioned in step 2.

If you dont know the code you are searching for, you will need to go through all the files that you got after step 2 and this can be bit tiring.

All the Best !

Improve this answer

1 Comment

When I try to do this, I get the following error: Error response from daemon: mkdir /var/lib/docker/tmp/docker-export-385434031: read-only file system. Is that complaining about my local file system, or something about the image I've just pulled from ECR?
1

There is a free open source tool called Anchore-CLI that you can use to scan container images. This command will allow you to list all files in a container image

anchore-cli image content myrepo/app:latest files

https://anchore.com/opensource/

EDIT: not available from anchore.com anymore, It's a python program you can install from https://github.com/anchore/anchore-cli

Improve this answer

Comments

-1

We can try a simpler one as follows:

docker image inspect image_id

This worked in Docker version:

DockerVersion": "18.05.0-ce"
Improve this answer

1 Comment

This doesn't show the contents; it only shows the layers, etc., that went into building the image.
-2

With Docker EE for Windows (17.06.2-ee-6 on Hyper-V Server 2016) all contents of Windows Containers can be examined at C:\ProgramData\docker\windowsfilter\ path of the host OS.

No special mounting needed.

Folder prefix can be found by container id from docker ps -a output.

Improve this answer

Comments

-2

You can just run the following code to see the content of docker image:

docker exec -it <image_id> sh
Improve this answer

Comments

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.