usefulweb.site Container Image Explorer

Security & supply-chain explorers

Container Image Explorer

Inspect a container image: platforms, layers, base image, root user, labels and cosign signature.

os/arch[/variant] picked from multi-platform images.

Offline mode, e.g. output of `docker buildx imagetools inspect --raw <image>`.

e.g. `crane config <image>` or `docker inspect` Config section.

Try an example: Pasted manifest + config of an illustrative Node app image (offline)

How it works

Reads an image straight from its registry (Docker Hub, GHCR, Quay or any OCI registry with anonymous pull): the index and per-platform manifests, layer sizes, digest, and the config blob (creation date, user, environment variable names, OCI labels such as source and revision, build history). Flags root user, likely secrets in env / build args, end-of-life base distributions, missing provenance labels and whether a cosign signature is published.

  • Registry access follows the Docker / OCI distribution token flow: an anonymous request is answered with a WWW-Authenticate Bearer challenge, a pull-scoped token is requested from the advertised realm (auth.docker.io, ghcr.io/token, …) and the request is retried. Only public images work.
  • GET /v2/<repo>/manifests/<tag> with OCI + Docker media types; for an index / manifest list the platforms are listed and the requested platform manifest is fetched. BuildKit attestation manifests (provenance / SBOM, platform unknown/unknown) are counted. The config blob is fetched by digest and its SHA-256 is checked against the manifest.
  • Cosign signatures are looked up by cosign's tag convention (sha256-<digest>.sig) for the image digest. Signatures stored only via the OCI referrers API or Sigstore bundles are not detected, and a found signature is not cryptographically verified here.
  • Root user: config.User empty, root or 0. Secrets: env names and build-arg names (from history "RUN |n NAME=…") matching password/secret/token/key patterns; values are never shown.
  • Base distribution is guessed from history, labels and env text and compared with an endoflife.date snapshot (2026-10-14). This tool does NOT scan layers for vulnerable packages — that needs a scanner such as Trivy or Grype run against the image.

For scripts and AI agents

  • JSON API: POST https://containerimageexplorer.usefulweb.site/api/v1/calculate (same calculation as this page)
  • Interface description: OpenAPI 3.1 · AI guide: llms.txt
  • MCP server (Streamable HTTP): https://containerimageexplorer.usefulweb.site/mcp · tool name container_image_explorer
Example request
curl -s -X POST https://containerimageexplorer.usefulweb.site/api/v1/calculate \
  -H 'content-type: application/json' \
  -d '{…see OpenAPI examples…}'

Related tools

  • SBOM Explorer – Open a CycloneDX or SPDX SBOM: components, licences, dependency tree and known vulnerabilities.
  • CVE Relationship Graph – One CVE or GHSA as a graph: aliases, affected packages, fixed versions, KEV status and EPSS.
  • Artifact Provenance Explorer – Verify npm build provenance: Sigstore signature, transparency log, source repo and commit.
Feedback