Inspecting a Singularity .sif file

Before running a newly acquired container, you can inspect its metadata, startup scripts, environment, and filesystem contents.

Inspection can identify suspicious or unexpected behavior, but such inspection doesn't necessarily guarantee that a container is free of malicious code. Trust is ultimately based on review, testing, and, ideally, verification of a signature from a trusted source.

Signed SIF Images

A signed .sif file allows users to verify that the image has not changed since it was approved and signed by a trusted source. Verification identifies the signer and confirms image integrity, but it does not guarantee that the image is safe or free of malicious content. Users should still inspect and review container contents before execution.

In general and if available, it's preferable to use a .sif image file that has been reviewed and signed by a trusted source.

See also

• ​Singularity User Guide: Signing and Verifying Containers
• ​Apptainer User Guide: Signing and Verifying Containers

Inspecting the .sif file

You can begin to inspect a .sif file with the sub-commands mentioned below.

Also, for more information, see the help messages for the following sub-commands.

1. singularity sign --help # sign a .sif file
2. singularity verify --help # verify a signed .sif file
3. singularity key --help # manage keys for signed .sif files
4. singularity inspect --help # inspect .sif file image components

In the following we assume that you've already entered an idev session and loaded the module singularity/3.9.0.

idev --partition=centos7
module load singularity/3.9.0

Or for workshop:

idev --partition=workshop7 -c 2
module load singularity/3.9.0

Inspecting Metadata and startup behavior

# Where did all the image components come from?
singularity inspect --deffile image.sif

# Are there any shell scripts or network I/O executed when the container starts?
singularity inspect --runscript image.sif

# Are any key, behavioral environment variables modified? (PATH, LD_LIBRARY_PATH, LD_PRELOAD, etc.)
singularity inspect --environment image.sif

# Inspect the author, version, build source, and other metadata.
singularity inspect --labels image.sif

Filesystem review

# Start the container's shell
singularity shell image.sif

# Is the Operating System (OS) the expected value?
cat /etc/os-release

# What software is installed?
# Ubuntu
dpkg -l
# RHEL/CentOS/Rocky/AlmaLinux/Fedora/SUSE/OpenSUSE
rpm -qa
# Arch Linux
pacman -Q
# Alpine Linux
apk list --installed

# What extra, custom software was added?
find /opt -type f 2>/dev/null

# What user-installed programs and scripts were added?
find /usr/local -type f 2>/dev/null

# Are there any unexpected privileged programs?
find / -perm -4000 2>/dev/null

# What network capabilities are included?
which curl wget ssh nc netcat socat

# Are any scheduled jobs configured to run automatically?
ls -R /etc/cron*