search

anchore / syft

CLI tool and library for generating a Software Bill of Materials from container images and filesystems
Apache License 2.0
6.05k stars 557 forks source link

docker-archive: support scanning a single image inside the archive #1054

Open bcmedeiros opened 2 years ago

bcmedeiros commented 2 years ago

With docker, we can save multiple images inside the same archive:

docker save img1:latest image2:latest > archive.tar

Currently, if an archive is generated like that, we get the following error:

unable to use DockerTarball source: cannot process multiple docker manifests

It would be awesome to be able to use those archives with a syntax like:

sync sbom -i docker-archive:archive.tar/img1:latest
wagoodman commented 2 years ago

Syft / stereoscope uses GGCR for this functionality, so we wouldn't be able to easily fix this behavior internally yet.

Code:

Related issues: