Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
The startup-generated `image/` directory is a `docker save`-style image layer layout. Analyze its `layer.tar` files and recover the secret file that a later-layer whiteout removed from the final filesystem view.
Inspect each layer.tar of the docker save-style image one by one
A later layer contains a .wh. whiteout (deletion marker); the file appears gone in the flattened image
That deleted file still physically exists in an earlier layer's layer.tar, and holds the flag