---
title: "Terrier: Open-Source Tool to Identify and Analyze Container and Image Components"
description: "Terrier is an open-source tool for identifying and verifying files and other components in OCI images and running containers, introduced alongside a Blackhat Europe talk on exploiting builds in the cloud. It targets supply-chain and forensic use cases, such as checking whether an image contains a known file or malicious package. YAML configuration selects image or container mode, supplies SHA256 hashes and, for container checks, paths; Terrier scans image layers or a container’s merged folder while keeping processing in memory for performance. Examples locate /usr/local/go/bin/go, report that the Jeilyfish package is absent, and verify curl and Go files in a running container; CircleCI and GitHub Actions examples show how checks can gate image-build pipelines."
---

# Terrier: Open-Source Tool to Identify and Analyze Container and Image Components

[Heroku](https://yomu.fyi/company/heroku) · chris le roy · Jan 15, 2020

**Type:** Tutorial

## Summary

Terrier is an open-source tool for identifying and verifying files and other components in OCI images and running containers, introduced alongside a Blackhat Europe talk on exploiting builds in the cloud. It targets supply-chain and forensic use cases, such as checking whether an image contains a known file or malicious package. YAML configuration selects image or container mode, supplies SHA256 hashes and, for container checks, paths; Terrier scans image layers or a container’s merged folder while keeping processing in memory for performance. Examples locate /usr/local/go/bin/go, report that the Jeilyfish package is absent, and verify curl and Go files in a running container; CircleCI and GitHub Actions examples show how checks can gate image-build pipelines.

## Context

The tool addresses the need to determine whether images or containers contain specific files, motivated by forensic analysis and identifying or preventing a supply-chain attack vector.

## Approach / What changed

Terrier uses YAML configuration files to scan OCI image layers or a container's merged folder for supplied SHA256 hashes and, for containers, specified paths. It can run as a CLI tool or within CircleCI and GitHub Actions pipelines, using in-memory processing for performance.

## Takeaways

- Terrier can inspect an OCI image tar archive and report the matching layer and path for a supplied SHA256 hash.
- Searching multiple hashes can check for known malicious files; the documented example found the Go binary and did not find the Jeilyfish Python package.
- Container verification supports specified paths and hashes, reports identification and verification counts, and returns exit code 0 when all documented checks pass.

**Tags:** [CI/CD](https://yomu.fyi/topic/ci-cd), [Docker](https://yomu.fyi/topic/docker), [Supply Chain](https://yomu.fyi/topic/supply-chain)

- Source: [Heroku](https://www.heroku.com/blog/terrier-open-source-identifying-analyzing-containers)
- Source URL: https://www.heroku.com/blog/terrier-open-source-identifying-analyzing-containers
- Ingested by Yomu: 2026-09-09T16:03:16.158Z

[Read original post](https://www.heroku.com/blog/terrier-open-source-identifying-analyzing-containers)