Exploring distroless images

Distroless images are all the rage in the container space these days due to the reduced attack surface. This is great and also results in much thinner images. But, when an image isn't behaving it can cause some additional trouble as you try to figure out what may be missing or broken without the ability to access the image.

  1. pull the image (if not already present)
  2. run a container (this mounts the image to create the filesystem)
  3. Export the image contents
    docker export hungry_mcnulty >contents.tar

This will provide the contents of the image and the container, so its good for debugging

Image-only solutions

If you just want to explore the layers and files in the image, you may find tools like dive (available on the Mac through brew) an appealing solution... well, if you like UI through the terminal.