Image Anatomy: Read the Layers, Find the Leaked Key

MediumDevOps20-30 min

The brief

You don't need a container runtime to understand a container image — it's just a tarball of layers and JSON. A saved image (docker save format) is at /root/case/image.tar. Unpack it and inspect its anatomy with tar and jq.

(1) The image's entrypoint (what it runs at startup) — from the image config → /root/case/answers/entrypoint.txt.

(2) The value of the `APP_HOME` environment variable the image sets → /root/case/answers/apphome.txt.

(3) A private key app/id_rsa was baked into one layer. Find which layer's `layer.tar` introduced it and record that layer's directory name → /root/case/answers/secret_layer.txt. A file belongs to the layer that added it — not necessarily the newest one.

See /root/case/brief.txt.

What you'll do

Unpack and read a container image's manifest and config without a runtime
Extract runtime metadata (entrypoint, env) from the image config
Trace which layer introduced a file — the basis of image supply-chain forensics

Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.