E-SKO
skopeo
CLI to inspect, copy, and sign container images and registries without a Docker daemon.
OVERVIEW
skopeo (github.com/containers/skopeo) is a command-line tool from the containers/ project that works with container images, repositories, and image transports — docker://, containers-storage:, oci:, dir:, and more — without ever requiring a running Docker daemon or root privileges. During a registry assessment it's the fastest way to pull a remote image's manifest, layers, and config to see what's actually published, without pulling gigabytes of layer data first.
Beyond inspection, skopeo copies images between registries (docker://src to docker://dst), deletes tags, and checks or applies signatures — useful when auditing whether a private registry enforces access control correctly or whether images are exposed with weaker permissions than the client believes.
USE CASES
Practical use cases
- 01
Pulling a remote image's manifest and config without downloading the full image layers.
- 02
Checking whether a private registry actually enforces authentication on pull/push.
- 03
Copying an image between registries to test cross-registry access controls.
- 04
Confirming whether published images carry valid signatures before trusting them in a pipeline.
QUICK START
When you need to pull manifest and config data from a registry, or copy/verify images between registries, without pulling a full image via Docker.
- Confirm the target registry and image are inside the agreed scope.
- Install skopeo from your package manager or build from source.
- Inspect the image to see its manifest, layers, and exposed metadata.
- If in scope, attempt an authenticated pull/copy to test registry access controls.
- Record any images returned without required authentication as a finding.
skopeo inspect docker://registry.example.com/app:latestBEFORE YOU RUN IT
What to check before running it
An unauthenticated inspect that succeeds against a registry meant to be private is itself the finding — confirm the client's expected access model before testing.
Copying or deleting tags is a write operation against the registry; scope exactly which repositories allow write-side testing before running --dest operations.
Signature verification only proves an image matches what was signed — it says nothing about vulnerabilities inside the image, which needs a separate scanner like Grype.