How to see the actual list of installed packages in TBS Jammy Full Stack

Products

• VMware Tanzu Build Service

Issue/Introduction

Tanzu Build Service(TBS) includes a subset of packages in Jammy Full Stack from Ubuntu Jammy that customer needs to cover the majority of cases in the various languages we support. Including everything would needlessly increase the CVE surface area of the stacks we ship for little payoff in that many of those packages are not needed by most application builds.
This article covers how to see the actual list of installed packages in TBS Jammy Full Stack.

Resolution

There's a couple of ways to see the actual list of installed packages:

• via the SBOM attached to the release on Github (e.g https://github.com/paketo-buildpacks/jammy-base-stack)
• running dpkg -l on a running container created from the image