dive

Usually by extracting the layers and looking through them. There's dive (https://github.com/wagoodman/dive) for making that easier.

A similar tool to this (includes interactive TUI) is https://github.com/wagoodman/dive

You're bang on, but you can do things with dive (https://github.com/wagoodman/dive) and use chunks of the code in other projects... That's what I've been doing. The license is MIT so it's permissive. But yes, an API would be ideal. I've wasted far too much time on this.

I'm not really understanding what this does specifically. It looks like it creates the filesystem on the host machine using chroot and then tarballs it? Is there an advantage to that over combining layers and using cache mounts to avoid those redundant downloads? A side-by-side comparison of dive's output would be helpful (https://github.com/wagoodman/dive). Also can you clarify what you mean by "requiring full rebuilds of all previous steps"?

This is great — I dragged a binary to the demo URL and it made me realize I had forgotten to pass `-ldflags="-s -w"` to strip the DWARF and symbol tables when I was building the binary. This will take my binaries from 25 MB down to 18 MB, a ~30% reduction in space. The container I'm building drops from 45 MB down to 36 MB, a 20% reduction. Every little bit helps when it comes to deploy times and space/speed savings! (for the container image size analysis I used dive, available here https://github.com/wagoodman/dive)

Not the person you asked, but I've done something like that several years ago, too. From alpine RUN apk add --no-cache $yourDependencies Add theSoftware /bin/theSoftware CMD rc-service yourDependency start && /bin/theSoftware You probably want to make that CMD into a bash script, produce theSoftware in another "from $yourRuntime as builderImage" and COPY from=builderImage though I'd strongly encourage you to explore the image with dive after to visualize whats been added on which command while you're changing the dockerfile https://github.com/wagoodman/dive I'd push back on that being a good idea though. It's okayish, but it'd be better if the software had no dependencies, falling back to file storage/embedded DB. But that's obviously scope screep, so probably not worth the effort if your chosen framework doesn't giv

ncdu dive https://github.com/wagoodman/dive

Cool, gonna try this soon. Would be great to use in combination with Dive (https://github.com/wagoodman/dive)

> Auditing a docker container is way more difficult/complex. I assume you mean auditing docker images. In which case, sure. That's why you grab their dockerfile and build it yourself. Though using dive[1] it's pretty easy to inspect docker images too, as long as they extend a base image you trust. [1] https://github.com/wagoodman/dive

Dive is a great tool for debugging this. I like image reduction work just because it gives me a chance to play with Dive: https://github.com/wagoodman/dive One easy low hanging fruit I see a LOT for ballooning image sizes is people including the kitchen sink SDK/CLI for their cloud provider (like AWS or GCP), when they really only need 1/100 of that. The full versions of both of these tools are several hundred mb each

You can inspect the layers of a Docker image. Tools like dive[0] provide a quick and easy way to navigate through the different components your image of choice is made up of. In terms of functionality once the container is running, you'll have to put some amount of trust into the project maintainers, no more or less than the trust you need om amd64. For containers repackaged by third parties that's quite a pain, but in most cases you can get by just fine with the official container. If your container of choice has been made by someone real fancy, you may be able to get reproducible builds for all the files inside the container. That would verify that the source and the binary match (though container metadata may not, so a direct image compare would be challenging). [0]: https://github.com/wagoodman/dive