Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Prepares any tarball containing a project so that a docker image can be built from it.
Prepares any tarball containing a project so that a docker image can be built from it
var fs = require('fs')
, dockerify = require('dockerify')
var intar = fs.createReadStream(__dirname + '/in.tar', 'utf8');
dockerify(intar, { strip: 1, dockerfile: __dirname + '/Dockerfile' })
.on('error', console.error)
.pipe(process.stdout)
# dockerify local file
cat in.tar | dockerify -l silly -c 'from ubuntu' -s 1 > out.tar
# dockerify github tarball
curl -L https://github.com/thlorenz/browserify-markdown-editor/archive/010-finished-dev-version.tar.gz |\
dockerify -s 1 -c 'from dockerfile/nodejs\nadd . src\n' --gz > out.tar
npm install dockerify
dockerify <options>
Creates a tarball stream into which a .tar or .tar.gz file can be piped in order to be dockerized
OPTIONS:
-l, --loglevel level at which to log: silly|verbose|info|warn|error|silent -- default: verbose
-h, --help Print this help message.
-g, --gz set this if you are piping a .tar.gz file
-s, --strip default: 0, sets the number of path segments to strip from each directory
-c, --content content of the Dockerfile, defaults to reading --dockerfile or to 'from ubuntu\n'
-d, --dockerfile file to read Dockerfile content from in case opts.content wasn't provided
-o, --override default: false if the project contains a Dockerfile at the root (after directories are stripped),
it will be overwritten with the content/file provided if this option is set
EXAMPLES:
dockerify a local tarball and strip outer directory, use default Dockerfile
cat in.tar | dockerify -l silly -s 1 > out.tar
dockerify a .tar.gz file release on github, setting dockerfile content - Note --gz option
curl -L https://github.com/thlorenz/browserify-markdown-editor/archive/010-finished-dev-version.tar.gz |\
dockerify -s 1 -c 'from dockerfile/nodejs\nadd . src\n' --gz > out.tar
Modifies the given tar stream according to given options. The main purpose is adding a Dockerfile so the resulting tar stream can be piped direclty into docker build
The returned tar stream emits the following events on top of the typical ReadableStream
events:
entry
emitted whenever an entry was processed and modifiedexisting-dockerfile
emitted whenever an existing Dockerfile was found and used instead of the supplied oneoverriding-dockerfile
emitted whenever an exising Dockerfile was overridden with the supplied onedefault: 0
sets the number of path segments to strip from each directoryopts.content
wasn't provided{boolean=} opts.override default: false
if the project contains a Dockerfile
at the root
(after directories are stripped), it will be overwritten with the content/file provided if this option is set
{Object} opts.stats allows setting mtime, mode, uname, gname, uid and gid of the created Dockefile
Name | Type | Description |
---|---|---|
stream | ReadableStream | the original tar stream |
opts | Object | @see above |
the transformed tar stream
Gunzips the .tar.gz stream and passes it along to tar
.
Name | Type | Description |
---|---|---|
stream | ReadableStream | .tar.gz stream |
opts | Object | @see |
the transformed tar stream
generated with docme
MIT
FAQs
Prepares any tarball containing a project so that a docker image can be built from it.
The npm package dockerify receives a total of 1 weekly downloads. As such, dockerify popularity was classified as not popular.
We found that dockerify demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.