Inspect container images with dive

Container images can be created using docker build with a Dockerfile, or with other tools such as jib or pack. Regardless of which tool was used to create the container image, you can use dive to inspect all layers that make up the final image.

# Container image and container image layer

A container image is a read-only, immutable file that contains the source code, libraries, dependencies, environment configuration, tools, and other files needed for an application to run. It has a human-readable name, a human-assigned tag, and can be used to create containers.

A container image layer is basically just an intermediate container image that has neither a name, nor a tag. You can think of a container image just as a diff of several container image layers.

The Open Container Initiative (OCI) came up with a specification for a standard format for container images. This means that you can use any tool to create a container image, as long as such tool produces a container image that adheres to the OCI specification.

# Dive vs other tools

If you are just interested in knowing what’s inside a container—which, remember, was built using a container image, i.e. the final container image layer—you can enter the container and have a look around.

For example, let’s say that you want to know what’s inside an Alpine Linux container.

First, you pull the container image from a container registry like Docker Hub:

docker pull alpine:latest

Second, you create a container and obtain a shell:

docker run --rm --interactive --tty alpine:latest
# or, for short
docker run --rm -it alpine:latest

Third, inside the Alpine container, you list all the files:

ls -1aR

But what if want to know how many layers there are, and how big they are? Well, for that there is docker history.

docker history alpine:latest

However, as far as I know, there is only one tool that allows you to inspect each layer that make up the final image, and that tool is dive.

# Installation

You can obtain dive by downloading and installing the binary from its GitHub releases, or by pulling its container image with docker pull wagoodman/dive:latest.

# How to use dive? A few examples

# Example 1: Alpine Linux

If you don’t have a local Alpine image, you can pull the latest one from Docker Hub with this command:

docker pull alpine:latest

You are now ready to inspect the container image layers with dive:

dive alpine:latest

You can switch panes with Tab, collapse/expand the file tree with the space bar, and exit the program with Ctrl+c.
You can read the documentation for the other keybindings.

Alpine is a Linux distro designed to be used in containers and embedded devices. Two of the main reasons of its small size (~5MB) are that Alpine packs 300+ UNIX tools in a single binary, thanks to BusyBox, and decided to pick musl as the implementation for the standard C library (see here how musl compares with glibc).

• buildpack
• container
• docker
• pack