Comment by a-nych
6 hours ago
Usually by extracting the layers and looking through them. There's dive (https://github.com/wagoodman/dive) for making that easier.
6 hours ago
Usually by extracting the layers and looking through them. There's dive (https://github.com/wagoodman/dive) for making that easier.
I fail to see how that’s useful. Why would I care about the layers inside an image when I could just extract the entire filesystem inside. Even then it is not useful if we don’t have a culture of reproducible builds.
Fair, "inspect the image" was a bad way to put it.
What I meant was: don't trust prebuilt images from a stranger, including mine. I've provided them just as a convenience, the Dockerfiles and patches can be easily looked-through, and building them yourself is the safer option if you need these docker images.