Evaluate tools for introspecting container images

The syft tool supports generating a SBOM for a container image and has support for Python packages. We should check to see if we can leverage this to support container images in pip-audit.

cc: @di

[woodruffw]

A further note in terms of reimplementing: Docker’s Python SDK is pretty well-featured, and includes a low-level API that might be able to do the kind of image introspection we need.

Edit: It looks like Tern uses the Docker Python SDK:

• https://github.com/tern-tools/tern/blob/87e7cdd154bc3cad98db1174b192ab9592adcffb/tern/analyze/default/container/multi_layer.py#L85-L120

• https://github.com/tern-tools/tern/blob/87e7cdd154bc3cad98db1174b192ab9592adcffb/tern/analyze/default/container/image.py

[woodruffw]

AFAICT the Docker daemon seems to be a requirement for Tern but not for stereoscope. I think we want something like stereoscope, but written in Python.

Yeah, I believe Docker’s Python SDK can’t really do anything without connecting to a Docker daemon. So if we don’t want to assume the presence of Docker, we probably can’t directly dupe or reuse their approach.

I’ll do some additional searching for something that looks like stereoscope, but in Python. It might also be possible to write a native Python extension that adapts stereoscope directly, although I’m not familiar with what that looks like with Go (I’ve done it for Rust and C/C++ and I’ve used Go extensions, but never written the latter).