RE: Busybox identification

Hi

Thank you. I guess I should have been clearer. My apologies. We save Docker images to disk and then unpack them and explore them as a file system to identify what is in them. From a layer perspective this works as we have to identify anything in each of the layers, even if the intent was to delete them.

This will rule out running any commands in the Docker image and just relying on what can be found in the file system and its structure.

/bin/busybox is a possibility.

This might just come down to running the list of files against a master list of Busybox packages and trying to ID what is installed that way. I was just hoping that there might be something simple and specific.

Kind regards,


Nigel Hopper
Security Consultant: Cybersecurity Assessment & Response Services
Open Source Software Auditor
Advisory Software Engineer
QSE Development Top Gun

My working week is Tuesday to Friday.

[signature_1589533700]

Phone: Office +44 (0) 1962815065<tel:+441962815065>
Phone: Mobile +44 (0) 7772 808235<tel:+447772808235>
E-mail: [email protected]<mailto:[email protected]>
Security and Legal Scanning Services

IBM UK Ltd, Mail Point 168, Hursley Park,
Winchester, Hampshire SO21 2JN


"One person with a belief is equal to a force of ninety-nine who only have interest."
"What distinguishes the majority of men from the few is their inability to act according to their beliefs."
- John Stewart Mill 1806 –1873


IBM United Kingdom Limited
Registered in England and Wales with number 741598
Registered office: Building C, IBM Hursley Office, Hursley Park Road, Winchester, Hampshire SO21 2JN

From: Jody Bruchon <[email protected]>
Date: Wednesday, 25 March 2026 at 14:50
To: Nigel Hopper <[email protected]>, [email protected] <[email protected]>
Subject: [EXTERNAL] RE: Busybox identification



On March 25, 2026 10:30:29 AM EDT, Nigel Hopper <[email protected]> wrote:
>Hi Jody
>
>I understand that it is not an OS as I mentioned in my original email.
>But we need a unique way of identifying if Busybox is installed.

ls /bin/busybox

>Since it is not an OS and does not use the os-release file, is there a
>way to uniquely identify if Busybox is installed and what version that
>might be?

strings -n 5 /bin/busybox | grep '[0-9]\.[0-9]'
--
Sent from my Android device with K-9 Mail. Please excuse my brevity.

Unless otherwise stated above:

IBM United Kingdom Limited
Registered in England and Wales with number 741598
Registered office: Building C, IBM Hursley Office, Hursley Park Road, Winchester, Hampshire SO21 2JN

_______________________________________________
busybox mailing list
[email protected]
https://lists.busybox.net/mailman/listinfo/busybox