E-CRA
Crane
CLI for pulling, pushing, and inspecting container images and manifests straight from a registry, no daemon required.
OVERVIEW
Crane, the flagship CLI of Google's go-containerregistry (github.com/google/go-containerregistry), speaks the OCI/Docker registry HTTP API directly, so it can pull, push, copy, and inspect images and manifests without a Docker daemon, a `docker login`, or root access to a socket — just registry credentials or, often, nothing at all against a public or misconfigured registry. `crane manifest`, `crane config`, and `crane export` retrieve exactly the JSON or filesystem content of an image with a single HTTP round trip each.
That makes it well suited to enumerating a registry a pentest has stumbled onto — listing tags with `crane ls`, checking whether an anonymous pull succeeds against a repo that should require auth, or exporting an image's filesystem for offline review — from any machine with network access to the registry, with none of the local setup or privilege that Docker itself requires.
USE CASES
Practical use cases
- 01
Checking whether a discovered container registry allows anonymous pulls when it should require authentication.
- 02
Listing tags and pulling manifests to enumerate what images/versions a registry exposes.
- 03
Exporting an image's filesystem (`crane export`) for offline review without needing a Docker daemon or root.
- 04
Copying an image between registries to stage it for further analysis, in scope-appropriate cases.
QUICK START
When you need to pull or inspect an image or its manifest straight from a registry, without a Docker daemon or the pull permissions daemon-based tools assume.
- Confirm the registry/repository is in scope, including whether anonymous-access testing against it is authorized.
- Install the `crane` binary (no daemon or registry login required for a public read).
- Use `crane ls <repo>` and `crane manifest <image>` to enumerate tags and inspect a manifest without pulling the full image.
- If deeper review is needed, use `crane export` to pull the filesystem for offline analysis with Dive or manual inspection.
crane manifest target-registry.example.com/app:latestBEFORE YOU RUN IT
What to check before running it
A successful anonymous pull against a registry that should be private is itself the finding — avoid pulling and retaining more images than needed to demonstrate it.
Any secret or credential surfaced via `crane export` or config inspection must be handled per the engagement's data-handling rules.
Push/copy operations are destructive to the target registry's state — only use them against a registry explicitly in scope, and never overwrite a tag in active use.