How to view files inside docker image without running it? (NOTE: THIS QUESTION IS HOW TO READ FILES WITHOUT RUNNING THE CONTAINER) [duplicate]

Question

Sometimes running the docker image fails so ssh’ing into the container is not an option. in that cases how do we see the content inside container?

There is a existing question but mistakenly marked as duplicate. how to browse docker image without running it?

NOTE: To stupid Moderators with stupid EGO, Please read the question PROPERLY before making judgement about closing the problem. Don't think you know better than others.

Countrywoman

The duplicate target of the question you cited has a couple of examples that don't involve running the container (docker export trying to examine the /var/lib/docker content directly). Mostly, though, you do need to actually run the image in some form to look around. – Regenaregency

Also consider docker run --rm -it imagename bash to get a temporary container, running an interactive shell instead of the default image CMD. This will let you explore things, and also try just running what the standard command should have been and see how it fails. – Regenaregency

1. I correctly stated that the question stated as duplicate is not a duplicate. – Countrywoman

2. the intention of this question IS TO EXAMINE WITHOUT RUNNING THE DOCKER CONTAINER – Countrywoman

Answer 1

Answering my own question.

you can add something like to override the entry point in the Dockerfile and run ls or cat command to see inside.

ENTRYPOINT ls /etc/fluentd

Countrywoman

You can also docker run --rm --entrypoint ls imagename /etc/fluentd without modifying the Dockerfile. This is kind of awkward, and you might update the Dockerfile to use CMD instead of ENTRYPOINT; then you could docker run --rm imagename ls /etc/fluentd. – Regenaregency

How is this "not running the container"? You're setting up all the namespaces -- the filesystem namespace, the user namespace, the PID namespace -- and invoking a process inside it. That's running the container. In particular, if the container contains a compromised ls executable, you just invoked that executable. (Even worse, if it contains a compromised /bin/sh executable, you just ran that, because this is really running sh -c 'ls /etc/fluentd' in the container). – Translucid

Whereas the docker export answer in the linked duplicate really is operating without running the container at all, and -- unlike the answer here -- works even if the container doesn't have sh or ls executables inside it. So that duplicate genuinely does have a legitimate answer to your question as you asked it, whereas the answer you added yourself doesn't meet your own specification. – Translucid