Container image validation using cuelang

[imjasonh]

Sort of like container-structure-test's metadata test, and file existence and contents tests, only using Cuelang instead of YAML.

---

Given an image I've previously built (in a registry, in a tarball, in an OCI layout), I may want to check if:

• the image's user, working dir, command/entrypoint, etc., is configured as I expect
• the image contains N layers:
  • possibly with some having certain digests (e.g., ensure it's based on some base image)
• the image's labels/annotations are specified as I expect
• the combined image layers (incl whiting out files) have some file path that:
  • does/doesn't exist
  • has certain permission bits, UID, GID, etc. set
  • contains certain contents (incl partial or exact contents)

[imjasonh]

...or CEL?

[imjasonh]

...or Starlark?