Inspect container contents without kubectl exec.
Click any container in a Pod view and browse its full filesystem - tree, sizes, symlinks, search, download. No docker pull, no exec, no local daemon. Private registries included.
“What actually shipped in this image?”
You're debugging a flaky deployment. The image tag is v2.4.0-rc3. You think it has a specific binary at /app/bin. You don't remember if the Dockerfile actually put it there.
Option A: kubectl exec -it pod -- ls /app/bin. That assumes the pod is still running. It assumes the container has ls installed. It assumes your distroless image has a shell, which it doesn't.
Option B: docker pull ... && docker run ... on your laptop. Now you need docker installed, you need the image-pull credentials the cluster uses (the ones you don't have on your laptop), and you're running a random container locally to answer a question about a remote one.
Radar's Image Filesystem Viewer skips both. It pulls the image layers directly from the registry using the cluster's own ImagePullSecrets, extracts them to a local cache, and shows you the filesystem in a tree. No docker. No exec. No shell in the image.
Browse, search, download - any image.
Full filesystem tree with sizes
Browse the image like a local directory. File sizes, permissions, symlinks - all rendered in a tree view with expandable directories. Discover what shipped without running the container.
Search across the entire image
Find every file matching a pattern across all layers. Useful when you're asking “does this image have a compiled binary at /app?” and don't want to shell in to find out.
Download individual files
Grab one file from the image without pulling the whole thing. Debug a bad config baked into a build, inspect a vendored binary, extract an embedded asset.
Private registries via ImagePullSecrets
Works with Docker Hub, Quay, GitHub Container Registry, GCR, ECR, and ACR. Radar reuses the cluster's existing ImagePullSecrets - no separate auth config to wire up.
Disk-based layer caching
First browse pulls and extracts layers to a local cache keyed by digest. Second browse of the same image reads straight from cache - no re-download, no re-decompression.
One click from any Pod
The viewer lives inside the Pod detail view. Click a container, click Image Filesystem, you're in. No separate tool to open, no docker daemon required, no mental context switch.
Four moments you'll actually use this.
Debug a distroless image
Distroless has no shell. `kubectl exec` returns exit 126. Radar shows you the filesystem anyway - because it doesn't need a shell in the image.
Confirm what CI actually built
The Dockerfile says `COPY dist /app`. Does the image really have `/app/index.html`? One click, find out, without pulling 2GB to your laptop.
Extract a config the app is using
Service reads config from `/etc/myapp.yaml`. That file is baked into the image, not mounted. Download it from the Radar UI, diff against your expected config, done.
Investigate a CVE
Security team says: “the patched binary should be at /usr/bin/openssl, version 3.0.14.” Open the image, navigate to `/usr/bin/openssl`, and see what actually shipped - download the binary and check its hash if you need proof. Faster than pulling and exec'ing anything.
How it actually works.
Registry pull, not docker
Radar talks the OCI distribution spec directly. No docker daemon, no containerd, no local runtime. Works on laptops without docker installed.
Reuses cluster secrets
Radar reads the Pod's ImagePullSecrets, passes them to the registry client, and pulls authenticated. Your private-registry access doesn't need to be replicated on your machine.
Cached by digest
Layer cache is keyed on digest. Two pods running the same image share the cache. Re-opening the viewer skips pull and extraction; the second engineer on the same image pays no download cost.
Apache 2.0. Yours to inspect, fork, or self-host.
Radar's source is on GitHub. Every feature on this page is in the binary you install with brew install. No telemetry, no mandatory login, no cluster data out. The one outbound call is an anonymous version check when the UI opens. If we ever change that, you'll see it in a diff first.
Questions we get about the image filesystem viewer.
Does this work on distroless images with no shell?
Do I need Docker installed to use it?
Does it work with private registries?
Can I download a single file instead of the whole image?
Does browsing the same image twice re-download it?
More of what Radar does in the same binary.
Issues & root cause
Failures grouped by subject, folded to the cause, with blast radius.
Applications view
Workloads folded into the apps they form, with health rollups and env skew.
GitOps for Argo + Flux
Fleet + per-app diagnosis with field-level drift, controller attribution, and lifecycle awareness.
Live topology graph
Every resource and connection, laid out by ELK.js, updated via SSE.
The view kubectl exec can't give you.
Browse any image's filesystem - distroless, private registry, whatever - without touching a running container.
Apache 2.0 OSS · Unlimited clusters self-hosted · Hosted free tier for up to 3 clusters