Skiff - OCI image analysis utility
summary
Skiff is a read only OCI image analysis utility built using podman's container libraries that shows uncompressed layer diff IDs and sizes, lists top files per layer (useful to spot leftover RPM temp files), and produces filesystem diffs with created/modified/deleted flags and size deltas so CI can block regressions. It mounts images without extracting via a FUSE mount streamed through a parent/child user namespace pair. Mounting is WIP, code is on GitHub.
AI-written summary · about
chapters (9)
- 0:00Skiff introduction
- 1:04Skiff origins
- 2:31Skiff as OCI analyzer
- 3:34Command skiff layers
- 4:59Command skiff top
- 6:04Command skiff diff
- 7:52Skiff mount WIP
- 9:38Skiff roadmap
- 11:03Closing remarks
related talks
15mSkiff - OCI image analysis utility
43mPodman, Buildah, Skopeo, and CRI-O A Year Later
33mOCI in CF: For Buildpacks, Security and Interoperability
35mEnhancing Software Composition Analysis Resilience Against Container Image Obfuscation
29mContainer Forensics for Kubernetes: Building an Evidence Pipeline With Open Source…
33mDetection of vulnerabilities and misconfigurations in production images
37mCSI Forensics: Unraveling Kubernetes Crime Scenes
23mViewing images through layered SBOMs