Terrier: Open-Source Tool to Identify and Analyze Container and Image Components

Summary

Terrier is an open-source tool for identifying and verifying files and other components in OCI images and running containers, introduced alongside a Blackhat Europe talk on exploiting builds in the cloud. It targets supply-chain and forensic use cases, such as checking whether an image contains a known file or malicious package. YAML configuration selects image or container mode, supplies SHA256 hashes and, for container checks, paths; Terrier scans image layers or a container’s merged folder while keeping processing in memory for performance. Examples locate /usr/local/go/bin/go, report that the Jeilyfish package is absent, and verify curl and Go files in a running container; CircleCI and GitHub Actions examples show how checks can gate image-build pipelines.

Takeaways

1. 1

   Terrier can inspect an OCI image tar archive and report the matching layer and path for a supplied SHA256 hash.

2. 2

   Searching multiple hashes can check for known malicious files; the documented example found the Go binary and did not find the Jeilyfish Python package.

3. 3

   Container verification supports specified paths and hashes, reports identification and verification counts, and returns exit code 0 when all documented checks pass.