Running Docker Inspector on Open Container Initiative (OCI) images

When given a docker image (--docker.image=repo:tag), Docker Inspector uses the docker-java library equivalent of docker save to save the image to a tar file. In this scenario, Docker Inspector should be able to pull, save, and inspect any image that could be pulled using a "docker pull" command. (Since Docker Inspector uses the docker-java library, the docker client executable does not actually need to be installed on the machine).

When given a saved docker tarfile (--docker.tar=image.tar), Docker Inspector requires a Docker Image Specification v1.2.0 format file. To inspect Open Container Initiative (OCI) format image files, we recommend using skopeo to convert them to Docker Image Specification v1.2.0 files. For example:

skopeo copy oci:alpine-oci docker-archive:alpine-docker.tar

will convert an OCI image directory alpine-oci to a Docker Image Specification v1.2.0 format file alpine-docker.tar that Docker Inspector can process when passed in with the --docker.tar=alpine-docker.tar command line argument.