How to inspect Docker image layers and size using dive

Why Docker image size matters in real-world scenarios

When we build containerized applications—which are isolated environments running software along with everything it needs—we rarely look inside the box. The creation process follows sequential steps where each instruction adds a brand-new file layer on top of the previous one. In practice, this means that if you download a massive package in one line and delete it in the next, the file remains hidden deep inside the history, weighing down the final result sent to the server.

This dynamic often triggers unpleasant surprises when pushing systems to the cloud or trying to speed up distribution pipelines. To address chronic storage issues, it is worth checking our guide on how to free up disk space in Docker via CLI, but preventing waste right at the build source is always the best approach.

What is dive and how it unveils Docker secrets

dive is an open-source utility built specifically to explore Docker images, their layers, and the contents of each layer interactively. Instead of guessing why an image suddenly bloated to gigabytes, the tool displays a two-column interface: on the left, you navigate through chronological layers, and on the right, you see the exact file system modifications introduced at that precise step.

When you run the inspection command, the program calculates an estimated efficiency score, showing whether there are duplicate files, modified items, or useless clutter accumulated along the way. This radical transparency changes how we write build instructions, letting engineers fix inefficiencies before they ever reach production environments and cause complex operational bottlenecks.

How to install and start using dive on your computer

Installing the utility is straightforward and can be done via traditional package managers on Linux, macOS, or universal command-line utilities. If you use Debian or Ubuntu-based distributions, you can download the binary package directly from the official GitHub repository or install it via Homebrew on Apple Silicon environments.

To jump straight into action without installing permanent local packages, you can run the inspector encapsulated inside a temporary container pointing to your local daemon socket. In practice, this means executing a direct instruction in your terminal that pulls and runs the tool, analyzing your target image in a completely isolated and safe manner.

docker run --rm -it -v /var/run/docker.sock:/var/run/docker.sock wagoodman/dive:latest my-project:latest

This command mounts your machine's Docker communication channel into the inspector container, allowing it to read local metadata without complications. Once the interface loads, you will see the statistical summary at the top, the layer list on the left panel, and the changed files on the right panel.

Navigating the interface and spotting space waste

Once the interactive interface opens, navigation flows intuitively using keyboard arrows and shortcut keys. The left column displays each command executed in the original configuration file, such as copying source codes or installing operating system dependencies. Selecting a specific layer reveals added files in green, removed files in red, and modified items in yellow on the right panel.

One of the biggest culprits uncovered by this visual inspection is temporary package manager cache files downloaded to install a library but never cleared in the same command line. Since the layered file system is immutable, deleting a file in a later layer simply creates a new removal instruction without reclaiming the physical space of the previous layer. Spotting this behavior is the first step toward rewriting instructions correctly and cleanly.

How to optimize your build instructions in practice

After identifying critical accumulation points through visual inspection, adjustments require structural changes in how we write package build instructions. Instead of spreading repository updates, tool installations, and cleanup across separate lines, we must group everything into a single chained instruction using logical operators like the double ampersand.

In practice, this ensures cache removal happens in the exact same physical context where the temporary file was generated, preventing dead weight from being saved in the final output. To deepen your continuous integration improvement strategies, you should also consult the recommendations on how to use remote cache in CI/CD to speed up slow builds.

Below is a classic example of an optimized instruction that installs dependencies and clears residual files in a single continuous block:

FROM ubuntu:22.04
RUN apt-get update && apt-get install -y \
    curl \
    git \
    && rm -rf /var/lib/apt/lists/*

This lean approach drastically cuts down total network transfer volume, saving bandwidth and registry disk space while accelerating the deployment cycle for new application releases. To explore these architectural concepts further in production, see our related technical analysis on Corrupted build? How to clear Maven cache in terminal.

Final thoughts on container auditing

Keeping strict control over Docker image sizes is no longer just an aesthetic whim—it has become a core requirement for operational efficiency and security in modern engineering. Visual inspection tools like dive turn an opaque black box into a transparent ecosystem where every single megabyte can be audited and justified with absolute clarity. By building the habit of regularly inspecting your packages before shipping them to production, your team gains agility, lowers infrastructure costs, and builds significantly more resilient and clean systems.