dockdiver
explore and extract Docker registry contents
TLDR
SYNOPSIS
dockdiver [options]
DESCRIPTION
dockdiver is a Go utility that enumerates and extracts the contents of a Docker registry exposed over the Registry HTTP API V2. It can list repositories, dump a single repository, or dump every repository, retrieving manifests, configuration blobs, and layer tarballs while verifying each blob with its SHA256 digest.It is aimed at penetration testing, bug bounty, and CTF scenarios where a registry (often a self-hosted one on port 5000) is reachable and may expose images that contain source code, configuration, or credentials. Authentication via Basic credentials or a bearer token, custom headers, proxy support, and a configurable request rate make it suitable for working against access-controlled or rate-limited registries.This tool targets the registry itself rather than the public Docker Hub web interface, and it downloads raw image data for offline inspection rather than scanning layers for secrets on its own.
PARAMETERS
-url STRING
Base URL or hostname of the Docker registry (required).-port INT
Registry port used when not specified in the URL. Default 5000.-list
List all repositories in the registry.-dump REPOSITORY
Download a single repository (manifest, config blob, and layer tarballs).-dump-all
Download all repositories found in the registry.-dir DIRECTORY
Output directory for dumped files. Default docker_dump.-username STRING
Username for HTTP Basic authentication.-password STRING
Password for HTTP Basic authentication.-bearer STRING
Bearer token for the Authorization header.-headers JSON
Custom request headers as JSON, e.g. '{"X-Custom": "Value"}'.-insecure
Skip TLS certificate verification.-rate INT
Requests per second. Default 3.-timeout DURATION
HTTP request timeout, e.g. 10s or 500ms. Default 30s.-proxy URL
Proxy URL (http, https, or socks5).-proxy-username STRING
Username for SOCKS5 proxy authentication.-proxy-password STRING
Password for SOCKS5 proxy authentication.
CAVEATS
Only registries reachable over the HTTP API V2 are supported. Use against registries you are authorized to access. Dumping all repositories can transfer large amounts of data; the default rate of 3 requests per second limits load and helps avoid tripping rate limits.
HISTORY
dockdiver is an open-source Go tool published on GitHub by MachiavelliII. It ships with a registry lab environment in its lab directory for safe testing.
SEE ALSO
dive(1), trivy(1), grype(1), docker-pull(1)
