Container image dataset

Prerequisites: Hardware/Software Specification/Version Details CPU Genuine Intel CPU, Single Core with four logical CPUs Operating System Ubuntu 24.04 LTS RAM / Hard Disk 8 GiB RAM (100 GB HDD/SSD) Docker Docker Version: 26.1.3 Trivy Version 0.67.0 Grype Version 0.100.0 Description / Replication InstructionsThis dataset contains Docker image archive files (.tar.gz) of container images used in our experiments. The following steps describe how to download, reconstruct, inspect, and analyze these images to reproduce our reported metrics (size, layer count, package / file / executable counts, vulnerability severity distribution, etc.). Step 1 – Download image archive(s) : Retrieve the image archive(s) from the Zenodo record use wget on Linux and manual download on Windows. #wget https://zenodo.org/record/17316682/files/image_name_tag.tar.gz Step 2 – Load the image into Docker : Use the docker load command to import the image from the archive:#docker load -i image_name_tag.tar Step 3 – Load compressed file to image use below command for each .tar.gz file #docker load < image_name_tag.tar.gz After this, the Docker engine will reconstruct the image (with its original name:tag). Step 4 – List loaded imagesVerify the image is loaded, and view its metadata (repository name, tag, size, etc.): #docker images Step 5 – Inspect layer countTo count how many layers the image has via docker inspect, This yields the total number of filesystem layers in the image.#docker inspect Image_name:tag --format='{{ len .RootFS.Layers }}' Step 6 – Install Grype (vulnerability / package scanner)We use Grype to analyze each image to determine package counts, file / executable counts, and vulnerability severities. Install Grype with: , This script installs Grype to /usr/local/bin. #curl -sSfL https://get.anchore.io/grype | sudo sh -s -- -b /usr/local/bin Step 7 – Run scanning on the imageRun Grype on the image to collect the metrics: #grype Image_name:tag This scan will output a report including: The total number of packages detected , The number of files (or file digests) , The number of executables (binary / script files) Vulnerability counts broken down by severity: Critical, High, Medium, Low. From this report you can extract the same metrics we report per image. In our published dataset summary, for each image we report the following attributes: Atribute Description Image Name and Tag The repository name and tag (e.g. httpd:2.4.65) using docker images command Image Size (MB) Size shown by docker images or docker inspect command Total Layers Number of layers (from .RootFS.Layers) Total Packages Count of software packages (from Grype Scan) Files Count of files / file digests (from Grype Scan) Executables Number of executable binaries / scripts (from Grype Scan) Critical / High / Medium / Low Vulnerability counts per severity class (from Grype Scan) Detail Description about why these Attribute Selected: Image Size (MB): This attribute captures the compressed size of the Docker image as stored in the registry or local cache, giving a direct measure of storage cost and potential transmission overhead. Total Layers: The number of filesystem layers from RootFS.Layers reflects how many discrete build steps or incremental changes have been applied, which can influence image complexity and potential for duplication or inefficiency. Total Packages: Counting the number of software packages detected by Grype indicates the software surface area in the image and helps approximate potential vulnerability attack vectors. Files: The total number of files scanned provides insight into the images file-level footprint and the comprehensiveness of the scanner’s coverage. Executables: The subset of files flagged as executable highlights the parts of the image that can actively run code, thus pointing to its dynamic or attackable surface.. Vulnerabilities (Critical / High / Medium / Low): For each severity tier, the count of detected vulnerabilities quantifies the security risk profile of the image, enabling comparative risk assessment across images.. We selected these parameters because they together capture both the structural complexity (size, layers) and security surface (package count, executable count, vulnerability severities) of container images, enabling a comparative analysis across images.” Sr.No. Image (name:tag) Category What we used / extracted 1 almalinux:9 OS / Base Image 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 2 fedora:39 OS / Base Image 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 3 busybox:1.36 Utility / Minimal OS 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 4 caddy:2.8.4 Web / Reverse Proxy 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 5 cassandra:4.0 NoSQL DB 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 6 couchdb:3.4 NoSQL DB 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 7 curlimages/curl:8.16.0 Utility / Tool 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 8 debian:11 OS / Base Image 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 9 elasticsearch:9.0.5 Search / Analytics DB 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 10 alpine:3.18 OS / Base (minimal) 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 11 gcc:11 Build Tool / Compiler 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 12 golang:1.21 Language / Runtime 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 13 haproxy:2.8 Load Balancer / Proxy 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 14 httpd:2.4.65 Web Server Image 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 15 influxdb:2.5 Time-series DB 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 16 joomla:4.4 Web Application / CMS 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 17 mariadb:10.6 SQL DB 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 18 mediawiki:1.41 Web Application / Wiki 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 19 memcached:1.6 Cache / In-memory Store 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 20 mongo:7.0 NoSQL DB 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 21 mysql:8.1 SQL DB 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 22 neo4j:4.4 Graph DB 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 23 nextcloud:25 Web Application / Storage 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 24 nginx:1.25 Web Server Image 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 25 node:18 Language / Runtime 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 26 openjdk:21 Language / Runtime 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 27 opensuse/ leap:15.6 OS / Base Image 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 28 oraclelinux:9 OS / Base Image 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 29 perl:5.38 Language / Runtime 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 30 photon:4.0 OS / Base (container OS) 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 31 php:8.1 Language / Runtime 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 32 postgres:15.2 SQL DB 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 33 python:3.11 Language / Runtime 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 34 quay.io/prometheus/ prometheus:v2.50.0 Monitoring / Metrics 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 35 rabbitmq:3.11 Message Broker / Middleware 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 36 redis:7.0 Cache / In-memory Store 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 37 redmine:5.0 Web Application / Project Management 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 38 rockylinux/rockylinux:8.6 OS / Base Image 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 39 ruby:3.1 Language / Runtime 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 40 rust:1.60 Language / Runtime 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 41 solr:9.5 Search / Indexing 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 42 swift:5.9 Language / Runtime 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 43 telegraf:1.35.3 Monitoring / Telemetry 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 44 tomcat:10.1 Web / App Server 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 45 ubuntu:22.04 OS / Base Image 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 46 vault:1.10.0 Secrets / Middleware 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 47 wordpress:6.8.2- php8.3-apache Web Application / CMS 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 48 znc:1.8 Chat / IRC Server 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 49 hylang:1.1.0 Language / Runtime 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 50 django:1.10.4 Web Framework / Application 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output. 51 owncloud:10.0.10 Web Application / Storage 1. Image Name with Image Tag. 2. Image size (MB) from docker images.3. Layers count from docker inspect.4. Total Package/Files/Executables count & vulnerability.5. Severities (Critical,High,Medium and Low) from Grype scan output.