Challenge
DifficultyEasy
Community stats167 solved of 219 attempts

Read OCI Image Labels Using ctr

Ivan Velichko
by  Ivan Velichko · on
Containers
Read the labels stored in a container image's config with ctr, and trace an image back to the Git commit it was built from.
#container-image#containerd#ctr#investigation

Premium Challenge

Upgrade your membership to unlock this and all other premium materials.

Upgrade

A container image can carry labels in its config. Build tools set them from the LABEL instruction of a Dockerfile or the --label flag of docker build, and the labels travel with the image to every registry and machine. In this challenge, you will read the labels of an image stored in containerd using ctr.

The machine has a registry.iximiuz.com/billing-api:1.4.2 image in containerd's default namespace. Its build recorded the Git commit of the source code in the standard org.opencontainers.image.revision label. Find the commit ID that the image was built from.

Hint 1

The LABELS column of sudo ctr image ls will not help here. It shows containerd labels, which ctr image label attaches to containerd's own record of an image. Those are a different kind of label, see Add and Read containerd Image Labels Using ctr challenge for more.

Other ctr commands may print containerd labels as well, so make sure that the value you find comes from the image config, where the OCI labels live under config.Labels.

Hint 2

The ctr image inspect command prints the tree of an image: its manifest, its config, and its layers. One of its flags adds the content of each of these blobs to the output.

Hint 3

The OCI labels are in the JSON content of the config blob (application/vnd.oci.image.config.v1+json), under config.Labels. The Labels boxes that ctr image inspect prints next to each blob show something else. They are containerd labels of the blobs in containerd's content store, such as containerd.io/gc.ref.content.config.

How to Author Challenges on iximiuz Labs

Instead of providing a subpar online editing experience, iximiuz Labs offers a helper CLI tool called labctl, allowing you to use your favorite text editor (or a full-featured IDE) to write content from the comfort of your local machine.

Install labctl CLI

curl -sf https://labs.iximiuz.com/cli/install.sh | sh

This will download and install the latest version of the labctl CLI. You only need to do this once per workstation.

Authorize labctl

labctl auth login

This will open a browser window asking you to authorize labctl to access your account. You need to do it after a fresh install of labctl and repeat it whenever the auth session expires.

Pull challenge content

labctl content pull challenge reading-image-labels-with-ctr

This will create a local copy of the challenge content in a directory named reading-image-labels-with-ctr. You only need to do this once per challenge.

Stream your changes

labctl content push -fw challenge reading-image-labels-with-ctr

Run this command in a separate terminal to continuously upload your changes to the server while editing the challenge in your favorite text editor or IDE.

You can also use labctl to create, list, and delete your content. Learn more about the available commands: labctl content --help

Start challenge