Analyzing Docker Images Without Downloading Them

jtodic — Wed, 31 Dec 2025 08:33:03 +0000

I built a tool that analyzes Docker image sizes directly from container registries — without pulling the images.

I needed to compare 50 versions of a Docker image to find when it got bloated. Pulling all tags would be slow and use gigabytes of bandwidth. Instead, I got all the data in seconds using registry metadata APIs.

The Key Insight

When you docker pull, the client fetches a manifest, then a config, then downloads all layers. The manifest and config are tiny JSON files (~10KB total). The layers are gigabytes.

But the manifest already contains layer sizes:

{
  "layers": [
    {"size": 29536818, "digest": "sha256:af6eca94..."},
    {"size": 1841029843, "digest": "sha256:c46e201c..."}
  ]
}

And the config contains the Dockerfile commands that created each layer:

{
  "history": [
    {"created_by": "apt-get install -y nginx", "empty_layer": false},
    {"created_by": "ENV PATH=/usr/local/bin:$PATH", "empty_layer": true}
  ]
}

Match them up (skipping empty_layer: true entries like ENV and LABEL), and you get layer sizes with their Dockerfile commands. No layer downloads needed.

Authentication

The tool reads ~/.docker/config.json — the same file Docker uses. For systems with credential helpers (macOS Keychain, Windows Credential Manager), it calls docker-credential-<helper> get directly.

You still need to run docker login first for private registries.

Multi-Architecture Images

Modern images return a manifest list instead of a manifest:

{
  "manifests": [
    {"digest": "sha256:abc...", "platform": {"architecture": "amd64"}},
    {"digest": "sha256:def...", "platform": {"architecture": "arm64"}}
  ]
}

One extra request to fetch the right platform's manifest. Still under 10KB.

Results

Approach	Data transferred
Pull all images	GBs (even with layer caching)
Metadata only	~500 KB (50 tags × ~10KB)

Try It

git clone https://github.com/jtodic/docker-time-machine.git
cd docker-time-machine
go mod download 
make build
make install

# Public images
./dtm registry nginx --last 20

# Private registries (after docker login)
./dtm registry your-registry.com/app --last 50 --format chart

🐳 I built a tool to find exactly which commit bloated your Docker image

jtodic — Thu, 04 Dec 2025 13:57:29 +0000

Ever wondered "why is my Docker image suddenly 500MB bigger?" and had to git bisect through builds manually? I made Docker Time Machine (DTM) - it walks through your git history, builds the image at each commit, and shows you exactly where the bloat happened.

Example:
dtm analyze --format chart

Gives you interactive charts showing size trends, layer-by-layer comparisons, and highlights the exact commit that added the most weight (or optimized it).
It's fast too - leverages Docker's layer cache so analyzing 20+ commits takes minutes, not hours.

GitHub: https://github.com/jtodic/docker-time-machine

Would love feedback from anyone who's been burned by mystery image bloat before 🔥

Examples of reports: