48

I'm just starting out with Docker, and it would be very helpful to be able to see the Dockerfiles used to create existing docker images.

Even if the image was built by running commands manually, and then committing to a tag, it would be nice to be able to see how the image was made, both for learning purposes and for security.

Is there a way to extract a Dockerfile or list of commands used to build a given docker image?

Edit (November 2021): Since people are still upvoting this, I can say that based on the answers and comments, I settled on:

docker history --no-trunc --format '{{.CreatedBy}}' <image> | grep -v '#(nop)' | tac

It produces output that is easy to put in a Dockerfile. Example:

$ docker history --no-trunc --format '{{.CreatedBy}}' qemu | grep -v '#(nop)' | tac
ENV DEBIAN_FRONTEND=noninteractive
RUN /bin/sh -c apt-get update && apt-get -y upgrade # buildkit
RUN /bin/sh -c apt install -y qemu-system-arm gcc-arm-none-eabi build-essential cmake bison flex # buildkit
RUN /bin/sh -c useradd --create-home qemu # buildkit
WORKDIR /home/qemu
USER qemu
COPY baremetal-arm baremetal-arm # buildkit

But as I also wrote, I don't think there is a good way to extract the Dockerfile, so if you need it, and can't find the source code, maybe give the image a pass.

mhvelplund
  • 2,099
  • 3
  • 22
  • 38
  • Does this answer your question? [How to generate a Dockerfile from an image?](https://stackoverflow.com/questions/19104847/how-to-generate-a-dockerfile-from-an-image) – user7610 Apr 04 '20 at 10:20
  • @user7610 not really :) I've come a long way since I asked that question. "docker history" was fine at the time, but since you can squash layers, my conclusion now is that there is no perfect way to do it. – mhvelplund Sep 03 '20 at 11:20

3 Answers3

48

You have docker history <image> that is very helpful. It can even be used to generate a dockerfile if none of the steps involved stdin.

If a step as stdin, the only way to know what happened would be to do docker logs <container id parent>, but if you do not have the container, you can't.

creack
  • 116,210
  • 12
  • 97
  • 73
16

There is undocker available now. We can install it by using the pip command.

pip install git+https://github.com/larsks/undocker/

and use

docker save IMAGE_NAME | undocker -i -o OUTPUT_DIR

to extract the files from docker.

https://github.com/larsks/undocker/

rgov
  • 3,516
  • 1
  • 31
  • 51
Dinesh
  • 889
  • 14
  • 34
  • 2
    This tool doesn't seem to do what was asked, which is how to recreate a Dockerfile. It unpacks files from a docker container. – rgov Aug 04 '21 at 01:24
  • @rgov The question was to extract the contents from a docker file, not to recreate it. – Dinesh Feb 22 '22 at 16:17
  • 1
    The request is to "see the Dockerfiles used to create existing docker images." The Dockerfile is the set of steps (`COPY`, `RUN`, `ENV`, etc.) used to create the image. It is *not* the contents of the container filesystem. – rgov Feb 22 '22 at 16:40
3

There's a project dockerfile-from-image which could help you to do it directly.

It requires a single CLI command to recover the Dockerfile:

docker run -v /var/run/docker.sock:/var/run/docker.sock centurylink/dockerfile-from-image <IMAGE_TAG_OR_ID>

One has to have Docker already installed.

Artem Oboturov
  • 4,344
  • 2
  • 30
  • 48
  • 11
    not work for me: /usr/lib/ruby/gems/2.2.0/gems/docker-api-1.24.1/lib/docker/connection.rb:42:in `rescue in request': 400 Bad Request: malformed Host header (Docker::Error::ClientError) – Julianesten Dec 26 '17 at 17:54
  • This worked, somewhat, for me on Linux using the rebuilt (but with the same dockerfile) image `dduvnjak/dockerfile-from-image` see the issue https://github.com/CenturyLinkLabs/dockerfile-from-image/issues/14 here. Looks like dependencies need to be updated to account for protocol changes. That said, it's not a complete solution - it doesn't rebuild (from my particular test) at least the `VOLUME` and `ENTRYPOINT` directives, and files specifically from that image's build step are just referenced as "pull from this other image". So it's a partial step in the process for a non-trivial dockerfile. – mbafford Sep 20 '21 at 12:58