search

genuinetools / img

Standalone, daemon-less, unprivileged Dockerfile and OCI compatible container image builder.
https://blog.jessfraz.com/post/building-container-images-securely-on-kubernetes/
MIT License
3.88k stars 229 forks source link

`img inspect` command: dump the JSON for the image config to stdout #324

Closed mitchellh closed 3 years ago

mitchellh commented 3 years ago

This CLI mimics docker inspect: it will print the OCI image config to stdout as raw JSON. This can be used with jq or other tools to extract useful metadata about an image.

Similar to img pull, img inspect only takes one image (unlike docker inspect which can take multiple and outputs an array). I felt it was more important to act like img than it was to act like Docker.

Tests included.

As for why? We're using img to do daemonless Docker builds but we need to do post-build inspection on the image. We used the Docker API previously for this (InspectImageWithRaw) but img provides not alternative for us. It'd be great to have this information.

Example:

CleanShot 2021-01-12 at 13 56 47@2x

(Note that the fact entrypoints and other stuff aren't visible in the above is showing the bug of #199 but that's wholly unrelated to this PR)

mitchellh commented 3 years ago

Thank you!

ccmtaylor commented 3 years ago

@mitchellh I noticed that the capitalisation of json keys differs in your screenshot (snake_case in the root, CamelCase inside config) vs the docker output you linked in #199 (CamelCase everywhere). Is that on purpose?

mitchellh commented 3 years ago

@mitchellh I noticed that the capitalisation of json keys differs in your screenshot (snake_case in the root, CamelCase inside config) vs the docker output you linked in #199 (CamelCase everywhere). Is that on purpose?

That is set by the OCI spec repository: https://pkg.go.dev/github.com/opencontainers/image-spec/specs-go/v1#Image (Somewhat oddly, they use lowercase on Image but CamelCase on ImageConfig 🤷 ). I'm not purposely doing either.

I think since we're already not compatible with the Docker version, my opinion is that whatever OCI is enforcing is fine with me.