Skip to main content
The image filesystem viewer lets you inspect container images referenced in the cluster and walk its files - same UX as a file tree in your editor. No Docker daemon is required. Radar reads the registry directly using the OCI distribution spec. Access depends on Radar’s network path, registry authentication and, in shared deployments, your Pod permissions. Radar image filesystem viewer - layer picker, file tree, inline file preview

​
When you’d reach for it

  • “Did our build actually include this binary?”
  • “Which version of OpenSSL is in this base image?”
  • “What’s in /etc/ld.so.conf.d/ for this distro?”
  • “Is the JVM truststore baked in or expected to be mounted?”
  • “Why is this image 1.2 GB?”

​
How to open it

Click an image reference in resource details. With authentication enabled, open it from a Pod you can read; workload views direct you to a Pod.

​
What’s in there

  • Layer picker - pick a layer to scope the file tree, or “All layers” to see the merged final filesystem.
  • File tree - browse top-down. Click a file to open it.
  • Search - find files by name across the whole image.
  • Inline view - text files render as text; binaries get hex; symlinks resolve to their target.
  • Download - any file can be downloaded individually.
  • Image metadata - manifest digest, config blob, exposed ports, env, entrypoint, cmd, working dir, OCI labels.
  • Layer details - per-layer size, instructions (when the image still carries history), and “what this layer added / changed.”

​
Auth & networking

Radar needs registry access from where it runs. Without authentication, it tries supplied pull secrets, the Google keychain for Google registries, then its Docker configuration (~/.docker/config.json). With authentication, inspection is tied to a readable Pod and its image. Using pull-secret credentials requires permission to read that Secret or exec in its namespace; Radar’s own credentials require exec permission and the pulled digest. Credentials require HTTPS. Private registries are supported, subject to network checks. See Image inspection authorization.

​
Performance

Layers are cached for a few minutes. Authenticated requests recheck registry access before serving cached data. Registry latency and image size affect load time.

​
Limits

  • No write. This is a read-only viewer; you can’t push back to the registry.
  • No exec. Use pod exec if you need a shell instead of a file viewer.
  • Compressed-only deltas. Layer-level diffs work on what the registry stores; if a layer rewrites a whole large file, that whole file appears as “changed”.

​
See also