Whaler
A Go program that reverse engineers Docker images to reconstruct the original Dockerfile.
What is Whaler?
Whaler is a Go program that reverse engineers Docker images to reconstruct the original Dockerfile that created them. It analyzes image layers, extracts added files, and detects potential secrets, helping developers audit, debug, and understand containerized applications.
DevOps engineers, security auditors, and developers who need to inspect, audit, or reverse engineer Docker images for debugging, security analysis, or recovering lost build instructions.
Whaler provides a straightforward, command-line tool for reconstructing Dockerfiles from existing images, offering insights into image composition and potential security issues without requiring access to the original source code.
Overview
Program to reverse Docker images into Dockerfiles
Use Cases
Best For
- Auditing Docker images for security vulnerabilities and exposed secrets
- Reverse engineering Docker images when the original Dockerfile is lost or unavailable
- Understanding how third-party or legacy Docker images were constructed
- Extracting files added via Docker ADD/COPY instructions for inspection
- Analyzing image metadata such as environment variables, ports, and users
- Debugging container issues by reconstructing the build process
Not Ideal For
- Teams needing deep binary forensics or content-based secret scanning in Docker images
- Developers who prefer GUI-based tools for container inspection and analysis
- Projects with complex multi-stage Docker builds where reconstruction might be incomplete
Pros & Cons
Pros
Automatically generates a Dockerfile by analyzing image layers, as stated in the README for understanding build processes without original source code.
Scans added filenames for potential secrets, aiding security audits by flagging suspicious file names, based on the README's feature list.
Extracts files added via ADD/COPY instructions, allowing direct inspection of image contents, as highlighted in the README.
Displays key configuration like ports, user, and environment variables for quick analysis, per the README's description.
Can be run in a Docker container with simple commands, simplifying setup and use without Go installation, as shown in the run examples.
Cons
Only detects secrets based on filenames, not file content, which can miss embedded credentials or obfuscated names, limiting security effectiveness.
Requires access to the Docker daemon socket (/var/run/docker.sock), posing security risks and restricting use in environments without Docker, as indicated in run commands.
Default filtering may not catch all noisy files like node_modules, and the README admits it's basic, potentially cluttering output.
Frequently Asked Questions
Related Projects
diveA tool for exploring each layer in a docker image
DockerSlimSlim(toolkit): Don't change anything in your container image and minify it by up to 30x (and for compiled languages even more) making it secure too! (free and open source)
kanikoBuild Container Images In Kubernetes
skopeoWork with remote images registries - retrieving information, images, signing content
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.