Changes between Initial Version and Version 1 of cypress/SingularityImageInspection

Timestamp:

08/31/2026 04:58:40 PM (5 days ago)

Author:

Carl Baribault

Comment:

Initial page

cypress/SingularityImageInspection

@@ +1 @@
+= Inspecting a Singularity .sif file = 
+
+Before running a newly acquired container, you can inspect its metadata, startup scripts, environment, and filesystem contents.
+
+Inspection can identify suspicious or unexpected behavior, but '''such inspection doesn't necessarily guarantee that a container is free of malicious code'''. Trust is ultimately based on review, testing, and, ideally, verification of a signature from a trusted source.
+
+
+== Signed SIF Images ==
+
+A signed '''.sif''' file allows users to verify that the image has not changed since it was approved and signed by a trusted source. Verification identifies the signer and confirms image integrity, but it does not guarantee that the image is safe or free of malicious content. Users should still inspect and review container contents before execution.
+
+For more information, see the help messages for the following sub-commands.
+
+ 1. '''singularity sign --help''' # sign a .sif file
+ 2. '''singularity verify --help''' # verify a signed .sif file
+ 3. '''singularity key --help''' # manage keys for signed .sif files
+ 4. '''singularity inspect --help''' # inspect .sif file image components
+
+In the following we assume that you've already entered an idev session and loaded the module singularity/3.9.0.
+
+
+{{{
+idev --partition=centos7
+module load singularity/3.9.0
+}}}
+
+Or for workshop:
+
+{{{
+idev --partition=workshop7 -c 2
+module load singularity/3.9.0
+}}}
+
+
+== Inspecting Metadata and startup behavior ==
+
+{{{
+# Where did all the image components come from?
+singularity inspect --deffile image.sif
+
+# Are there any shell scripts or network I/O executed when the container starts?
+singularity inspect --runscript image.sif
+
+# Are any key, behavioral environment variables modified? (PATH, LD_LIBRARY_PATH, LD_PRELOAD, etc.)
+singularity inspect --environment image.sif
+
+# Inspect the author, version, build source, and other metadata.
+singularity inspect --labels image.sif
+}}}
+
+
+== Filesystem review ==
+
+
+{{{
+# Start the container's shell
+singularity shell image.sif
+
+# Is the Operating System (OS) the expected value?
+cat /etc/os-release
+
+# What software is installed?
+# Ubuntu
+dpkg -l
+# RHEL/CentOS/Rocky/AlmaLinux/Fedora/SUSE/OpenSUSE
+rpm -qa
+# Arch Linux
+pacman -Q
+# Alpine Linux
+apk list --installed
+
+# What extra, custom software was added?
+find /opt -type f 2>/dev/null
+
+# What user-installed programs and scripts were added?
+find /usr/local -type f 2>/dev/null
+
+# Are there any unexpected privileged programs?
+find / -perm -4000 2>/dev/null
+
+# What network capabilities are included?
+which curl wget ssh nc netcat socat
+
+# Are any scheduled jobs configured to run automatically?
+ls -R /etc/cron*
+}}}