3 ms·

So it should generally be possible to go from image --> dockerfile as the information is included in the manifest. If you save an image as a .tar.gz you can ex

So it should generally be possible to go from image --> dockerfile as the information is included in the manifest. If you save an image as a .tar.gz you can extract the info from there or there are also tools to reverse engineer Dockerfiles from images https://samaritan.ai/blog/reversing-docker-images-into-dockerfiles/ https://samaritan.ai/blog/reversing-docker-images-into-docke... That is a good point about lack of reproducability though. I suppose an interesting attack would be to deliberately forge information in the manifest before pushing to Docker hub... I also tend to use anything other than the official images as "inspiration" and re-implement myself.

cyphar 8y ago
> I suppose an interesting attack would be to deliberately forge information in the manifest before pushing to Docker hub... "Forge" is a bit of a strong word. The main reason Docker included build information in the image history was so that build caching would work (from memory). It's not meant to be an authoritative source of information about how an image was built at all (not to mention that "RUN apt-get update" tells you almost nothing about what packages were installed, when they were updated, etc). Personally I think that the current trend of using Dockerfiles is completely broken in terms of reproduciblity and introspectability (I'm working on a blog post to better explain the issue).