List, inspect and explore OCI container images, their layers and contents

https://github.com/bschaatsbergen/lix

49•bschaatsbergen•1mo ago

Comments

Ristovski•1mo ago

A similar tool to this (includes interactive TUI) is https://github.com/wagoodman/dive

just_mc•1mo ago

Dive is a very nice tool. I've been using it for years.

hollow-moe•1mo ago

Dive is awesome, it just tends to be a bit slow and eats up a lot of RAM when inspecting big images...

bschaatsbergen•1mo ago

While they may look similar at first glance, Dive and Cek target different use cases. Dive is great at visualizing layer content and analyzing image efficiency, but requires the Docker daemon and can't extract file contents. Cek is daemonless (works with any container runtime or none at all) and focuses on providing a programmatic interface: `ls`, `tree`, `cat`, etc. for exploring a container's overlay filesystem and layers.

jzelinskie•1mo ago

I think the most common tools for similar workflows is Google's crane[0] and Red Hat's Skopeo[1]. It might be slightly more low-level than most developers want, though.

[0]: https://github.com/google/go-containerregistry/blob/v0.20.7/...

[1]: https://github.com/containers/skopeo

bmitch3020•1mo ago

This project even depends on go-containerregistry. Also in this space is RedHat's scopeo, Microsoft's oras, and my own regctl.

And my favorite project for inspecting layers is Jon's https://oci.dag.dev/.

bschaatsbergen•1mo ago

Skopeo and crane are both fantastic tools, but they address different problems at a different level. Skopeo and crane operate at the image registry level, handling pulling, pushing, synchronizing, etc. cek is focused on what's in the container itself, providing a programmatic way to explore a container’s (overlay) filesystem and layers with commands like ls, tree, and cat.

exceptione•1mo ago

There is a bit of overlap with Skopeo (from the podman team), that too can inspect (remote) images. It mainly focuses on image management though, like syncing from/to a registry.

compsciphd•1mo ago

All these tools demonstrate a major flaw in OCI images. There is no good way to determine what image your current image was built on top of.

You can try to infer it from having a world wide list of chainIds and associate known images with their final chainId, but this isn't perfect and then just assume your image's changes are from last_known_chaid_id+1->end

1) many image tags can share a chainId (not terrible problem) 2) if for some reason you dont know of an image, but know of its parent, you will assume its "parent" is your base image, when its not.

I don't quite understand why OCI images don't contain a reference to the base image that they were created from (which can even be empty/no parents for from scratch images, including where multistage builds are down and everything gets copied into a from scratch image).

bschaatsbergen•1mo ago

That's, indeed, a spec limitation, not something cek can solve. If you're interested in provenance tracking, you might want to look at Sigstore's cosign attestations or GUAC (Graph for Understanding Artifact Composition).

compsciphd•1mo ago

right. this is me complaining about the spec, not the tools. I've worked on tooling in this space. I simply don't understand why there seems to be no desire to make a simple addition to the spec.

Study confirms experience beats youthful enthusiasm

The Big Hunger by Walter J Miller, Jr. (1952)

The Genus Amanita

We have broken SHA-1 in practice

Ask HN: Was my first management job bad, or is this what management is like?

Ask HN: How to Reduce Time Spent Crimping?

KV Cache Transform Coding for Compact Storage in LLM Inference

A quantitative, multimodal wearable bioelectronic device for stress assessment

Why Big Tech Is Throwing Cash into India in Quest for AI Supremacy

How to shoot yourself in the foot – 2026 edition

Eight More Months of Agents

From Human Thought to Machine Coordination

The new X API pricing must be a joke

Show HN: RMA Dashboard fast SAST results for monorepos (SARIF and triage)

Show HN: Source code graphRAG for Java/Kotlin development based on jQAssistant

Python Only Has One Real Competitor

Tmux to Zellij (and Back)

Ask HN: How are you using specialized agents to accelerate your work?

Passing user_id through 6 services? OTel Baggage fixes this

DavMail Pop/IMAP/SMTP/Caldav/Carddav/LDAP Exchange Gateway

Visual data modelling in the browser (open source)

Show HN: Tharos – CLI to find and autofix security bugs using local LLMs

Oddly Simple GUI Programs

The New Playbook for Leaders [pdf]

Interactive Unboxing of J Dilla's Donuts

OneCourt helps blind and low-vision fans to track Super Bowl live

Rudolf Vrba

Autism Incidence in Girls and Boys May Be Nearly Equal, Study Suggests

Wellness Hotels Discovery Application

NASA delays moon rocket launch by a month after fuel leaks during test

Study confirms experience beats youthful enthusiasm

The Big Hunger by Walter J Miller, Jr. (1952)

The Genus Amanita

We have broken SHA-1 in practice

Ask HN: Was my first management job bad, or is this what management is like?

Ask HN: How to Reduce Time Spent Crimping?

KV Cache Transform Coding for Compact Storage in LLM Inference

A quantitative, multimodal wearable bioelectronic device for stress assessment

Why Big Tech Is Throwing Cash into India in Quest for AI Supremacy

How to shoot yourself in the foot – 2026 edition

Eight More Months of Agents

From Human Thought to Machine Coordination

The new X API pricing must be a joke

Show HN: RMA Dashboard fast SAST results for monorepos (SARIF and triage)

Show HN: Source code graphRAG for Java/Kotlin development based on jQAssistant

Python Only Has One Real Competitor

Tmux to Zellij (and Back)

Ask HN: How are you using specialized agents to accelerate your work?

Passing user_id through 6 services? OTel Baggage fixes this

DavMail Pop/IMAP/SMTP/Caldav/Carddav/LDAP Exchange Gateway

Visual data modelling in the browser (open source)

Show HN: Tharos – CLI to find and autofix security bugs using local LLMs

Oddly Simple GUI Programs

The New Playbook for Leaders [pdf]

Interactive Unboxing of J Dilla's Donuts

OneCourt helps blind and low-vision fans to track Super Bowl live

Rudolf Vrba

Autism Incidence in Girls and Boys May Be Nearly Equal, Study Suggests

Wellness Hotels Discovery Application

NASA delays moon rocket launch by a month after fuel leaks during test

List, inspect and explore OCI container images, their layers and contents

Comments