Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Intelligence View
⚡ tsecurity.de Intelligence

Filtering Docker Images

Filtering Docker Images Filtering Docker Images with --filter flag This lab provides a detailed overview of using the --filter flag with the docker images command and docker search command. Introduction The docker images command is a…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

Filtering Docker Images



Filtering Docker Images with --filter flag



This lab provides a detailed overview of using the --filter flag with the docker images command and docker search command.



Introduction

The docker images command is a powerful tool for listing and managing Docker images on the host system. By using the --filter flag, we can refine the output to show only the images that meet specific criteria. This can help us manage our images more efficiently and keep our system organized.



Filtering with the --filter Flag



The --filter flag allows us to specify conditions that Docker uses to filter the list of images. This flag can be combined with various options to target specific images based on their properties.



Dangling Images

A dangling image is an image that is no longer tagged and appears in listings as :. These images typically result from updating an existing image tag, leaving the old image without a tag.



Image description



Image description



Image description




`$ docker images --filter dangling=true`






REPOSITORY TAG IMAGE ID CREATED SIZE

4fd34165afe0 7 days ago 14.5MB

To remove all dangling images, we can use:




`$ docker image prune`






Repository-Specific Images

To list images from a specific repository, we can use the reference filter:




`$ docker images --filter reference="alpinelinux/docker-cli"`






Image description



REPOSITORY TAG IMAGE ID CREATED SIZE

alpinelinux/docker-cli latest d4e867dc1611 4 days ago 161MB

Images Before a Specific Image

To list images created before a specific image:




`$ docker images --filter before=alpine`






Image description



REPOSITORY TAG IMAGE ID CREATED SIZE

nginx stable-perl e790832271e7 5 weeks ago 236MB

busybox latest 65ad0d468eb1 12 months ago 4.26MB

Images Since a Specific Image

To list images created after a specific image:




`$ docker images --filter since=alpine`

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8s91b1h857kh6fgg9bq1.png)


REPOSITORY TAG IMAGE ID CREATED SIZE
nginx latest 4f67c83422ec 18 hours ago 188MB
alpinelinux/docker-cli latest d4e867dc1611 4 days ago 161MB






Images with Specific Labels

This filtering is particularly useful in CI/CD pipelines where there is a need to deploy, test, or manage specific versions of Docker images based on labels.



Let's assume we have several Docker images on our system, and some of these images have been tagged with a specific label, com.example.version=1.0.



To filter and list only the images that have this label, we would use the following command:




`$ docker images --filter label=com.example.version=1.0`






Image description



Here’s an example output for the above command:




REPOSITORY   TAG       IMAGE ID       CREATED          SIZE
myapp v1.0 656bf8d8e0c1 17 minutes ago 7.8MB







In this example:



The image myapp with the tag v1.0 has the label com.example.version=1.0.

The image anotherapp with the tag latest also has the label com.example.version=1.0.

Adding Labels to Images

If we want to create a Docker image with a specific label, we can do so during the build process. Here’s an example Dockerfile that includes a label:




# Example Dockerfile
FROM alpine:latest
LABEL com.example.version="1.0"
COPY . /app
CMD ["sh", "/app/start.sh"]






To build this image and tag it as myapp:v1.0, we would use:




$ docker build -t myapp:v1.0 .






After building, this image will have the label com.example.version=1.0, and we can verify this by using the filter command.



Images by Reference

To list images with the latest tag:




$ docker images --filter reference="*:latest"
REPOSITORY TAG IMAGE ID CREATED SIZE
busybox latest 3596868f4ba8 7 days ago 3.72MB
alpine latest 44dd6f223004 9 days ago 7.73MB
redis latest 2334573cc576 2 weeks ago 111MB






Formatting Output

The --format flag allows us to customize the output using Go templates. For example, to display only the sizes of the images:




$ docker images --format "{{.Size}}"
3.72MB
7.73MB
111MB
265MB
58.1MB






We can also customize the output of docker images command output to display only the repository, tag, and size of each image:




$ docker images --format "{{.Repository}}: {{.Tag}}: {{.Size}}"

busybox: latest: 3.72MB
alpine: latest: 7.73MB
redis: latest: 111MB
portainer/portainer-ce: latest: 265MB
nigelpoulton/tu-demo: latest: 58.1MB






Advanced Filtering

For more complex filtering needs, we can leverage our operating system's shell tools like grep and awk. Additionally, Docker Desktop extensions may offer enhanced filtering capabilities.



Example Scenario: Combining Filters and Shell Tools

To find and delete images larger than 100MB:



Image description




$ docker images --format "{{.Repository}} {{.Size}}" | awk '$2 > 100 {print $1}{print $2}'

konami98/reverse-proxy:
898MB
reverse-proxy-np:
898MB
reverse-proxy:
898MB
origin2:
901MB
konami98/origin:
901MB
1.45GB
1.07GB
cnrancher/autok3s:
319MB
rancher/k3s:
188MB
1.2GB






Filtering Docker images using the --filter flag helps manage and maintain a clean and efficient Docker environment. By understanding and utilizing the available filters, we can streamline our Docker image management process and ensure our system remains organized.

1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Vulnerability Remediation & Verification
Syntax validiert (0 Fehler)
title: Detect Exploitation - Filtering Docker Images
id: c508b01e-f9f8-4b2a-a04a-9c9b47d94420
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-27
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
Syntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-27"
        description = "YARA Signature for "
    strings:
        $str = "Filtering Docker Images" ascii wide
    condition:
        any of them
}
Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("Filtering Docker Images")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
Syntax validiert (0 Fehler)
message: "*Filtering Docker Images*"
Syntax validiert (0 Fehler)
CommonSecurityLog
| where Message has "Filtering Docker Images"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

2. Cyber Threat Intelligence & Forensik

CTI Threat Relationship Graph2 Knoten / 1 Relationen
CVE / Incident Software MITRE ATT&CK CWE Weakness IoC
🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Analyse für identifizierte Bedrohung auf Basis von Live-CTI (ENISA EUVD): CVSS 0.0 · EPSS 0.0% · CISA KEV: nein. Handlungsableitung aus den verlinkten Hersteller-Quellen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten Filtering Docker Images

Thematisch verwandte Begriffe: Filtering, Docker, Images · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

💬 Kommentare werden geladen…
Zum Aktualisieren ziehen
ZERO-DAY CVE-2025-71424 | Contrast, Edgeless Systems' runtime for confidential containers on Kuber…
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag