Docker

Query docker.ecosyste.ms for Docker Hub image metadata and the system/language packages installed inside images (via Syft SBOMs). Use when checking what's inside a Docker image, finding which images ship a given OS or language package, or browsing Linux distro variants.From its SKILL.md

Install

npx -y skills add ecosyste-ms/skills --skill docker

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
fetches URLsInstructs the agent to fetch 8 URLs, including https://docker.ecosyste.ms/api/v1/packages/library%2Fnginx and 7 more.

SKILL.md

2.6 KB, 666 tokens by cl100k_base, as published. Nobody here has run it

ecosyste.ms Docker API

Base URL: https://docker.ecosyste.ms/api/v1

All responses are JSON. No auth required. Set a User-Agent header.

Full OpenAPI spec: https://docker.ecosyste.ms/docs/api/v1/openapi.yaml

Docker images

Image names containing / must be URL-encoded (%2F). Official images live under the library/ namespace.

curl -s 'https://docker.ecosyste.ms/api/v1/packages/library%2Fnginx'
curl -s 'https://docker.ecosyste.ms/api/v1/packages/grafana%2Fgrafana'

Returns: name, description, downloads, versions_count, latest_release_number, latest_release_published_at, dependencies_count, has_sbom, repository_url.

Image versions (tags) and their contents

curl -s 'https://docker.ecosyste.ms/api/v1/packages/library%2Fnginx/versions'
curl -s 'https://docker.ecosyste.ms/api/v1/packages/library%2Fnginx/versions/1.27.0'

The version response includes a dependencies array listing every OS and language package found in the image SBOM (ecosystem, name, version).

Reverse lookup: which images contain a package

Ecosystem names here come from Syft: deb, rpm, apk, npm, pypi, gem, golang, maven, cargo, nuget, composer, binary. Package names with / must be URL-encoded.

# how many images ship this package, total downloads of those images
curl -s 'https://docker.ecosyste.ms/api/v1/usage/npm/lodash'
curl -s 'https://docker.ecosyste.ms/api/v1/usage/deb/openssl'
curl -s 'https://docker.ecosyste.ms/api/v1/usage/golang/github.com%2Fstretchr%2Ftestify'

# list all ecosystems with counts
curl -s 'https://docker.ecosyste.ms/api/v1/usage'

# packages in an ecosystem ranked by image count
curl -s 'https://docker.ecosyste.ms/api/v1/usage/apk?per_page=20'

Linux distros

Distros and versions detected from /etc/os-release across indexed images:

curl -s 'https://docker.ecosyste.ms/api/v1/distros'
curl -s 'https://docker.ecosyste.ms/api/v1/distros/alpine-3-19'
curl -s 'https://docker.ecosyste.ms/api/v1/distros/alpine-3-19/versions'

Pagination

List endpoints accept ?page=N&per_page=N.

When to use

Inspecting what packages are bundled inside a Docker image without pulling it
Finding which popular images include a vulnerable system library
Estimating the Docker-side blast radius of a package
Comparing base image distro choices

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.

Gives 0 of the 12 instructions most containers cloud skills give in 666 tokens

Counted across 607 of the 705 authors here whose files we hold, read 2026-09-06

Run as non-root userin 34 of 607, across 27 files
Use multi-stage buildsin 29 of 607
Set resource requests and limitsin 24 of 607, across 20 files
Configure liveness and readiness probesin 18 of 607, across 14 files
Use named volumes for persistent datain 14 of 607, across 9 files
Pin base image versionsin 14 of 607
Set up environment variablesin 14 of 607, across 10 files
Pin provider versionsin 14 of 607
Apply least privilege RBAC permissionsin 10 of 607, across 7 files
Create a dockerignore filein 10 of 607
Use remote state with lockingin 9 of 607
Pin base images by digestin 9 of 607, across 8 files

Said here and by no other author read

Set a User-Agent header
URL encode image names containing slashes

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.