Locate and examine container images in OpenShift

In OpenShift you typically use ImageStreams to manage images, not raw images directly - providing abstraction and efficient management.

ImageStreams are sequence of pointers to images that can be associated with deployments. They provide a level of abstraction and allow you to manage images more efficiently.

These images are typically stored in internal OpenShift registry which can be the internal OpenShift image registry or an external registry like quay.io or Docker Hub.

By default every OpenShift cluster installation includes useful sets of RedHat provided ImageStreams that make it easy for developers to create new applications – they are in the openshift project:

oc -n openshift get imagestream

To get more detailed information about a specific ImageStream:

oc -n openshift describe is ubi8-openjdk-8

you can see its labels, annotations, repository etc.

We can further inspect the image by copying the sha256 from previous ouput and use get and describe:

oc get image sha256:bf5e518dba2aa935829d9db88d933a264e54ffbfa80041b41287fd70c1c35ba5
oc describe image sha256:bf5e518dba2aa935829d9db88d933a264e54ffbfa80041b41287fd70c1c35ba5

review the output to get the insights of the image.

Another way to examine a container image is to use extract command to download the image contents to your local file system. Running this command will extract the file system contents of the specific image and send them to the target on your local machine:

mkdir test
cd test/
oc image extract registry.access.redhat.com/ubi8/openjdk-8@sha256:bf5e518dba2aa935829d9db88d933a264e54ffbfa80041b41287fd70c1c35ba5