Docker: Reverse Engineering of an Image

Question

When we use Docker it's very easy push and pull image in a public repository in our https://hub.docker.com but this repository it's free only for public image(only one can be private).

Currently it's possible to execute a reverse engineering of a public image in repository and read the source code of project ?

Answer 1

You can check how an image was created using docker history <image-name> --no-trunc

Update:

Check dive which is a very nice tool that allows you to views image layers.

Answer 2

As yamenk said docker history is the key to this.

As https://github.com/CenturyLinkLabs/dockerfile-from-image is broken, you can use recent

https://hub.docker.com/r/dduvnjak/dockerfile-from-image/

Extract from the site

Note that the script only works against images that exist in your local image repository (the stuff you see when you type docker images). If you want to generate a Dockerfile for an image that doesn't exist in your local repo you'll first need to docker pull it.

For example, you can run it agains itself, to see the code

$ docker run --rm -v /run/docker.sock:/run/docker.sock centurylink/dockerfile-from-image ruby
FROM buildpack-deps:latest
RUN useradd -g users user
RUN apt-get update && apt-get install -y bison procps
RUN apt-get update && apt-get install -y ruby
ADD dir:03090a5fdc5feb8b4f1d6a69214c37b5f6d653f5185cddb6bf7fd71e6ded561c in /usr/src/ruby
WORKDIR /usr/src/ruby
RUN chown -R user:users .
USER user
RUN autoconf && ./configure --disable-install-doc
RUN make -j"$(nproc)"
RUN make check
USER root
RUN apt-get purge -y ruby
RUN make install
RUN echo 'gem: --no-rdoc --no-ri' >> /.gemrc
RUN gem install bundler
ONBUILD ADD . /usr/src/app
ONBUILD WORKDIR /usr/src/app
ONBUILD RUN [ ! -e Gemfile ] || bundle install --system