Skip to content
OPS // KITitspentest.sh

E-SKO

skopeo

CLI to inspect, copy, and sign container images and registries without a Docker daemon.

Official siteBack to catalog

OVERVIEW

skopeo (github.com/containers/skopeo) is a command-line tool from the containers/ project that works with container images, repositories, and image transports — docker://, containers-storage:, oci:, dir:, and more — without ever requiring a running Docker daemon or root privileges. During a registry assessment it's the fastest way to pull a remote image's manifest, layers, and config to see what's actually published, without pulling gigabytes of layer data first.

Beyond inspection, skopeo copies images between registries (docker://src to docker://dst), deletes tags, and checks or applies signatures — useful when auditing whether a private registry enforces access control correctly or whether images are exposed with weaker permissions than the client believes.

USE CASES

Practical use cases

  • 01

    Pulling a remote image's manifest and config without downloading the full image layers.

  • 02

    Checking whether a private registry actually enforces authentication on pull/push.

  • 03

    Copying an image between registries to test cross-registry access controls.

  • 04

    Confirming whether published images carry valid signatures before trusting them in a pipeline.

QUICK START

When you need to pull manifest and config data from a registry, or copy/verify images between registries, without pulling a full image via Docker.

  1. Confirm the target registry and image are inside the agreed scope.
  2. Install skopeo from your package manager or build from source.
  3. Inspect the image to see its manifest, layers, and exposed metadata.
  4. If in scope, attempt an authenticated pull/copy to test registry access controls.
  5. Record any images returned without required authentication as a finding.
skopeo inspect docker://registry.example.com/app:latest

BEFORE YOU RUN IT

What to check before running it

An unauthenticated inspect that succeeds against a registry meant to be private is itself the finding — confirm the client's expected access model before testing.

Copying or deleting tags is a write operation against the registry; scope exactly which repositories allow write-side testing before running --dest operations.

Signature verification only proves an image matches what was signed — it says nothing about vulnerabilities inside the image, which needs a separate scanner like Grype.

KEEP EXPLORING

View the whole phase →