How to see docker image contents

Question

I did a docker pull and can list the image that's downloaded. I want to see the contents of this image. Did a search on the net but no straight answer. Thanks.

Answer 1

We can try a simpler one as follows:

docker image inspect image_id

This worked in Docker version:

DockerVersion": "18.05.0-ce"

Answer 2

You can just run an interactive shell container using that image and explore whatever content that image has.

For instance:

docker run -it image_name sh

Or, if you want to see how the image was build, meaning the steps in its Dockerfile, you can:

docker image history --no-trunc image_name > image_history

The steps will be logged into the image_history file.

Answer 3

The accepted answer here is problematic, because there is no guarantee that an image will have any sort of interactive shell. For example, the drone/drone image contains on a single command /drone, and it has an ENTRYPOINT as well, so this will fail:

$ docker run -it drone/drone sh
FATA[0000] DRONE_HOST is not properly configured        

And this will fail:

$ docker run --rm -it --entrypoint sh drone/drone
docker: Error response from daemon: oci runtime error: container_linux.go:247: starting container process caused "exec: \"sh\": executable file not found in $PATH".

This is not an uncommon configuration; many minimal images contain only the binaries necessary to support the target service. Fortunately, there are mechanisms for exploring an image filesystem that do not depend on the contents of the image. The easiest is probably the docker export command, which will export a container filesystem as a tar archive. So, start a container (it does not matter if it fails or not):

$ docker run -it drone/drone sh
FATA[0000] DRONE_HOST is not properly configured        

Then use docker export to export the filesystem to tar:

$ docker export $(docker ps -lq) | tar tf -

The docker ps -lq there means "give me the id of the most recent docker cotnainer". You could replace that with an explicit container name or id.

Answer 4

Docker is still under construction. The last time I checked it did not have this feature as part of the command line tools.

You can however try docker inspect on an image. You'll see a section called Data under GraphDriver. Here you have paths such as UpperDir that you can run find on.

This might not work with all storage drivers for docker.

Answer 5

You should not start a container just to see the image contents. For instance you might want to look for malicious content, not run it. Use "create" instead of "run";

docker create --name="tmp_$$" image:tag docker export tmp_$$ | tar t docker rm tmp_$$

Answer 6

With Docker EE for Windows (17.06.2-ee-6 on Hyper-V Server 2016) all contents of Windows Containers can be examined at C:\ProgramData\docker\windowsfilter\ path of the host OS.

No special mounting needed.

Folder prefix can be found by container id from docker ps -a output.