Dive: Analyze Docker Image Layers

Dive is a tool for exploring Docker image layers, showing exactly what files each layer adds, modifies, or removes. It helps identify wasted space, unnecessary files, and optimization opportunities in your Docker images. This guide covers installation, usage, and practical image optimization techniques.

Installation

# Linux
wget https://github.com/wagoodman/dive/releases/download/v0.12.0/dive_0.12.0_linux_amd64.deb
sudo apt install ./dive_0.12.0_linux_amd64.deb

# macOS
brew install dive

# Docker (no installation needed)
docker run --rm -it -v /var/run/docker.sock:/var/run/docker.sock wagoodman/dive:latest myimage:tag

Basic Usage

# Analyze a local image
dive myapp:latest

# Analyze from registry
dive nginx:1.27

# Build and analyze in one step
dive build -t myapp:latest .

# CI mode (returns exit code based on efficiency)
dive myapp:latest --ci
CI=true dive myapp:latest

Understanding the Interface

Dive shows two panels:

• Left panel — image layers with size, command, and cumulative size
• Right panel — file tree for selected layer showing added/modified/removed files

# Key bindings:
# Tab        — switch between layers and file tree
# Arrow keys — navigate layers/files
# Space      — collapse/expand directories
# Ctrl+A     — show only added/modified files
# Ctrl+U     — show unmodified files
# Ctrl+R     — show removed files

Identifying Wasted Space

# Common wasteful patterns Dive reveals:

# 1. Package manager caches left in layers
# Look for: /var/cache/apt/, /var/lib/apt/lists/, /root/.cache/pip/
# Fix: RUN apt-get clean && rm -rf /var/lib/apt/lists/* in same layer

# 2. Build tools in final image
# Look for: gcc, make, git, dev packages
# Fix: Use multi-stage builds

# 3. Unnecessary files copied
# Look for: .git/, node_modules/ (in non-Node images), test files
# Fix: Use .dockerignore

# 4. Layer that adds then removes files
# A file added in layer 3 and removed in layer 5 still takes space
# Fix: Combine operations in a single RUN command

CI Integration

# .dive-ci config file
rules:
  lowestEfficiency: 0.9      # Fail if below 90% efficient
  highestWastedBytes: 20MB   # Fail if more than 20MB wasted
  highestUserWastedPercent: 0.1  # Fail if more than 10% wasted

# GitHub Actions
- name: Analyze image with Dive
  run: |
    dive myapp:latest --ci --ci-config .dive-ci

Optimization Workflow

1. Run dive myapp:latest to see current layer structure
2. Identify large layers and wasted space
3. Optimize Dockerfile (combine RUN, multi-stage, .dockerignore)
4. Rebuild and re-analyze with Dive
5. Compare efficiency scores

Best Practices

• Run Dive on every image before pushing to production
• Add Dive CI checks to your build pipeline
• Aim for 90%+ image efficiency
• Use Dive to verify multi-stage builds correctly exclude build dependencies
• Check for accidental inclusion of secrets or credentials in image layers