Analyzing image layers with dive in Docker - Deep Dive

Overview - Analyzing image layers with dive

What is it?

Dive is a tool that helps you look inside Docker images to see how they are built layer by layer. It shows you what files each layer adds, changes, or removes. This helps you understand the size and contents of your Docker images clearly.

Why it matters

Without tools like Dive, it is hard to know why a Docker image is large or what exactly is inside it. This can lead to bloated images that waste storage and slow down deployments. Dive helps you find and fix these problems, making your images smaller and faster.

Where it fits

Before using Dive, you should know basic Docker concepts like images, containers, and layers. After mastering Dive, you can move on to optimizing Dockerfiles and building efficient CI/CD pipelines.

Mental Model

Core Idea

Dive lets you explore each layer of a Docker image like peeling an onion, revealing what files were added or changed at every step.

Think of it like...

Imagine building a sandwich layer by layer, and Dive lets you see each ingredient added one at a time, so you know exactly what makes the sandwich taste and look the way it does.

Docker Image
┌─────────────────────────────┐
│ Layer 3: App files          │
│  + /app/main.py             │
│  - /app/temp.txt            │
├─────────────────────────────┤
│ Layer 2: Dependencies       │
│  + /lib/libxyz.so           │
│  + /bin/tool                │
├─────────────────────────────┤
│ Layer 1: Base OS            │
│  + /bin/bash                │
│  + /etc/hosts               │
└─────────────────────────────┘

Build-Up - 7 Steps

1

Foundation

Understanding Docker Image Layers

Concept: Docker images are made of layers stacked on top of each other, each adding or changing files.

A Docker image is built step-by-step from a Dockerfile. Each command creates a new layer. Layers store only the changes from the previous layer, like adding or deleting files.

Result

You get a layered image where each layer represents a change, making images reusable and efficient.

Understanding layers is key because Dive analyzes these layers to show what changed at each step.

2

Foundation

Installing and Running Dive

Concept: Dive is a command-line tool that you install and run to inspect Docker images.

To install Dive, you can download it from its official GitHub or use package managers. Then run it with: dive Example: dive nginx:1.23.3

Result

Dive opens an interactive interface showing image layers and file changes.

Knowing how to install and launch Dive is the first step to exploring image internals.

3

Intermediate

Navigating Dive's Interface

🤔Before reading on: do you think Dive shows only file sizes or also file changes per layer? Commit to your answer.

Concept: Dive's interface shows layers, file changes, and size impact, letting you explore details interactively.

Dive screen has three main parts: - Left: list of layers with commands that created them - Right top: files added, modified, or deleted in the selected layer - Right bottom: size and efficiency stats You can move up/down layers and see exactly what changed.

Result

You can identify which layer added large files or unnecessary data.

Knowing how to navigate Dive helps you pinpoint exactly where image bloat or issues come from.

4

Intermediate

Interpreting Layer Efficiency Metrics

🤔Before reading on: do you think a layer with many small files is always efficient? Commit to your answer.

Concept: Dive calculates efficiency scores showing how much space each layer uses effectively versus wasted.

Dive shows metrics like: - Layer size - Wasted space (files deleted later but still in image) - Efficiency percentage This helps find layers that add files only to remove them later, wasting space.

Result

You learn which layers to optimize to reduce image size.

Understanding efficiency metrics guides you to clean up Dockerfiles and avoid common size pitfalls.

5

Intermediate

Using Dive to Optimize Dockerfiles

Concept: By analyzing layers, you can rewrite Dockerfiles to combine commands or remove unnecessary files.

For example, if Dive shows a layer adds temp files that are deleted in a later layer, you can combine those commands in one RUN step to avoid adding them to the image. Example: Instead of: RUN apt-get update && apt-get install -y pkg RUN rm -rf /var/lib/apt/lists/* Combine: RUN apt-get update && apt-get install -y pkg && rm -rf /var/lib/apt/lists/*

Result

Your image becomes smaller and more efficient.

Using Dive to guide Dockerfile changes saves time and avoids guesswork in optimization.

6

Advanced

Analyzing Multi-Stage Build Images

🤔Before reading on: do you think Dive can show all stages in a multi-stage Docker build or only the final image? Commit to your answer.

Concept: Dive can analyze multi-stage builds by inspecting the final image layers, helping understand what each stage contributed.

Multi-stage builds create temporary images to reduce final size. Dive shows the final image layers, so you can see what files survived and which were discarded. You can compare images from different stages by running Dive on each stage's image tag.

Result

You gain insight into how multi-stage builds reduce size and what files are included.

Knowing how to analyze multi-stage builds helps you verify your build strategy actually reduces image size.

7

Expert

Dive's Internal Layer Diff and Cache Analysis

🤔Before reading on: do you think Dive reads image layers from Docker daemon or downloads and extracts them itself? Commit to your answer.

Concept: Dive reads image layers directly from Docker's local storage and compares filesystem changes between layers to show diffs and cache usage.

Dive accesses Docker image layers stored as tar archives on disk. It extracts and compares files between layers to detect additions, modifications, and deletions. It also analyzes Docker's build cache usage by showing which layers are reused or rebuilt. This deep inspection allows Dive to provide accurate layer content and efficiency data.

Result

You understand Dive's accuracy and limitations depend on Docker's local image storage and layer format.

Knowing Dive's internals explains why it can show detailed diffs and why it requires local Docker images.

Under the Hood

Dive works by accessing Docker's local image storage, which contains layers as compressed tar files. It extracts each layer and compares its filesystem changes against the previous layer. This lets Dive identify which files were added, modified, or deleted in each layer. It also calculates size and efficiency metrics by summing file sizes and detecting wasted space from deleted files still stored in lower layers.

Why designed this way?

Docker images use layered filesystems to save space and speed up builds. Dive was designed to leverage this layering by inspecting each layer's filesystem changes directly. This approach avoids rebuilding images or running containers, making analysis fast and safe. Alternatives like running containers to inspect files are slower and less precise.

Docker Image Layers
┌───────────────┐
│ Layer N       │
│ + new files   │
│ - deleted files│
├───────────────┤
│ Layer N-1     │
│ + new files   │
│ - deleted files│
├───────────────┤
│ ...           │
├───────────────┤
│ Layer 1       │
│ + base files  │
└───────────────┘

Dive extracts each layer's tarball
and compares files to previous layer
→ shows diffs and size metrics

Myth Busters - 4 Common Misconceptions

Quick: Does Dive modify your Docker images when analyzing them? Commit to yes or no.

Common Belief: Dive changes or rebuilds Docker images to analyze them.

Reality: Dive only reads existing Docker images locally without modifying or rebuilding them.

Why it matters: Believing Dive modifies images can cause unnecessary fear or hesitation to use it, missing out on its safe analysis benefits.

Quick: Do you think all large files in an image always come from the last layer? Commit to yes or no.

Common Belief: The largest files in a Docker image always come from the last layer added.

Reality: Large files can come from any layer; sometimes earlier layers add big files that remain unchanged.

Why it matters: Assuming only the last layer matters can lead to missing optimization opportunities in earlier layers.

Quick: Does deleting a file in a later layer remove it from the final image size? Commit to yes or no.

Common Belief: Deleting files in later layers reduces the image size by removing those files completely.

Reality: Deleting files only hides them in the final image but does not remove their data from lower layers, so image size may not shrink.

Why it matters: Misunderstanding this leads to inefficient Dockerfiles that appear clean but produce large images.

Quick: Can Dive analyze images stored remotely without pulling them locally? Commit to yes or no.

Common Belief: Dive can analyze Docker images directly from remote registries without downloading them first.

Reality: Dive requires the image to be present locally; it cannot analyze remote images without pulling them.

Why it matters: Expecting remote analysis can cause confusion and workflow delays.

Expert Zone

1

Dive's layer diffing accounts for file metadata changes (like permissions) even if content is unchanged, which can affect size calculations subtly.

2

The efficiency score includes wasted space from files deleted in later layers but still stored in earlier layers, revealing hidden bloat.

3

Dive can be scripted in CI pipelines to automatically detect image size regressions by parsing its JSON output mode.

When NOT to use

Dive is not suitable when you need to analyze images not stored locally or when you want to inspect running containers' dynamic state. For those cases, tools like container exec or remote image scanners are better.

Production Patterns

In production, Dive is used to audit images before deployment, ensuring minimal size and no unnecessary files. Teams integrate Dive into CI pipelines to catch image bloat early. It also helps during Dockerfile refactoring to verify that multi-stage builds effectively reduce image size.

Connections

Filesystem Snapshots

Dive's layer analysis is similar to how filesystem snapshots track changes over time.

Understanding snapshot diffs helps grasp how Docker layers store only changes, which Dive visualizes.

Version Control Systems

Like Git tracks changes between commits, Dive tracks file changes between image layers.

Knowing version control concepts clarifies how Dive compares layers as incremental changes.

Supply Chain Security

Dive helps verify image contents, which is crucial for secure software supply chains.

Using Dive to inspect images supports trust and transparency in software delivery.

Common Pitfalls

#1 Assuming deleting files in a later layer reduces image size.

Wrong approach:

Dockerfile:
RUN apt-get install -y pkg
RUN rm -rf /var/lib/apt/lists/*

Correct approach:

Dockerfile:
RUN apt-get install -y pkg && rm -rf /var/lib/apt/lists/*

Root cause:

Misunderstanding that each RUN creates a new layer, so deleting files in a separate layer does not remove their data from previous layers.

#2 Trying to analyze an image not pulled locally with Dive.

Wrong approach:

dive myregistry.com/myimage:latest (without pulling first)

Correct approach:

docker pull myregistry.com/myimage:latest
Dive myregistry.com/myimage:latest

Root cause:

Not knowing Dive requires local image presence to analyze layers.

#3 Ignoring Dive's layer navigation and only looking at total image size.

Wrong approach:

Running dive and only reading the summary without exploring layers.

Correct approach:

Interactively navigate layers in Dive to find which layer adds large or unnecessary files.

Root cause:

Missing the interactive exploration feature leads to superficial understanding and missed optimization chances.

Key Takeaways

Docker images are built in layers, each adding or changing files, and Dive lets you explore these layers in detail.

Dive helps identify which layers add unnecessary files or waste space, guiding you to optimize Dockerfiles effectively.

Deleting files in later layers does not reduce image size unless combined in the same layer where they were added.

Dive requires images to be present locally and does not modify images during analysis, making it safe to use.

Understanding Dive's detailed layer diffs and efficiency metrics empowers you to build smaller, faster, and more secure Docker images.