CODEWITHSUNDEEP
dockerreverse-engineeringdockerhubdocker-image
daniele3004
daniele3004

Reputation: 13930

Docker: Reverse Engineering of an Image

When we use Docker it's very easy push and pull image in a public repository in our https://hub.docker.com but this repository it's free only for public image(only one can be private).

Currently it's possible to execute a reverse engineering of a public image in repository and read the source code of project ?

Upvotes: 35

Views: 37921

Answers (4)

milahu
milahu

Reputation: 3559

dfimage and dockerfile-from-image are broken

dedockify works

imageName=ruby:latest
docker pull $imageName
docker images # -> get imageId
imageId=xxxxxxxxxxxx
# write to Dockerfile
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock mrhavens/dedockify $imageId >Dockerfile

Upvotes: 2

JimChien
JimChien

Reputation: 91

You can use laniksj/dfimage to reverse engineering of an image.

For example:

# docker run -v /var/run/docker.sock:/var/run/docker.sock laniksj/dfimage <YOUR_IMAGE_ID>
FROM node:12.4.0-alpine
RUN /bin/sh -c apk update
RUN /bin/sh -c apk -Uuv add groff less python py-pip
RUN /bin/sh -c pip install awscli
RUN /bin/sh -c apk --purge -v del py-pip
RUN /bin/sh -c rm /var/cache/apk/*
RUN /bin/sh -c apk add --no-cache curl
ADD dir:4afc740ff29e4a32a34617d2715e5e5dc8740f357254bc6d3f9362bb04af0253 in /app
COPY file:b57abdb61ae72f3a25be67f719b95275da348f9dfb63fb4ff67410a595ae1dfd in /usr/local/bin/
WORKDIR /app
RUN /bin/sh -c npm install
ENTRYPOINT ["docker-entrypoint.sh"]
CMD ["node" "app.js"]

Upvotes: 5

user2915097
user2915097

Reputation: 32176

As yamenk said docker history is the key to this.

As https://github.com/CenturyLinkLabs/dockerfile-from-image is broken, you can use recent

https://hub.docker.com/r/dduvnjak/dockerfile-from-image/

Extract from the site

Note that the script only works against images that exist in your local image repository (the stuff you see when you type docker images). If you want to generate a Dockerfile for an image that doesn't exist in your local repo you'll first need to docker pull it.

For example, you can run it agains itself, to see the code

$ docker run --rm -v /run/docker.sock:/run/docker.sock centurylink/dockerfile-from-image ruby
FROM buildpack-deps:latest
RUN useradd -g users user
RUN apt-get update && apt-get install -y bison procps
RUN apt-get update && apt-get install -y ruby
ADD dir:03090a5fdc5feb8b4f1d6a69214c37b5f6d653f5185cddb6bf7fd71e6ded561c in /usr/src/ruby
WORKDIR /usr/src/ruby
RUN chown -R user:users .
USER user
RUN autoconf && ./configure --disable-install-doc
RUN make -j"$(nproc)"
RUN make check
USER root
RUN apt-get purge -y ruby
RUN make install
RUN echo 'gem: --no-rdoc --no-ri' >> /.gemrc
RUN gem install bundler
ONBUILD ADD . /usr/src/app
ONBUILD WORKDIR /usr/src/app
ONBUILD RUN [ ! -e Gemfile ] || bundle install --system

Upvotes: 9

yamenk
yamenk

Reputation: 51798

You can check how an image was created using docker history <image-name> --no-trunc

Update:

Check dive which is a very nice tool that allows you to views image layers.

Upvotes: 35

Related Questions