Analyzing Docker Images Without Downloading Them

I built a tool that analyzes Docker image sizes directly from container registries — without pulling the images.

I needed to compare 50 versions of a Docker image to find when it got bloated. Pulling all tags would be slow and use gigabytes of bandwidth. Instead, I got all the data in seconds using registry metadata APIs.

The Key Insight

When you docker pull, the client fetches a manifest, then a config, then downloads all layers. The manifest and config are tiny JSON files (~10KB total). The layers are gigabytes.

But the manifest already contains layer sizes:

{
  "layers": [
    {"size": 29536818, "digest": "sha256:af6eca94..."},
    {"size": 1841029843, "digest": "sha256:c46e201c..."}
  ]
}

And the config contains the Dockerfile commands that created each layer:

{
  "history": [
    {"created_by": "apt-get install -y nginx", "empty_layer": false},
    {"created_by": "ENV PATH=/usr/local/bin:$PATH", "empty_layer": true}
  ]
}

Match them up (skipping empty_layer: true entries like ENV and LABEL), and you get layer sizes with their Dockerfile commands. No layer downloads needed.

Authentication

The tool reads ~/.docker/config.json — the same file Docker uses. For systems with credential helpers (macOS Keychain, Windows Credential Manager), it calls docker-credential-<helper> get directly.

You still need to run docker login first for private registries.

Multi-Architecture Images

Modern images return a manifest list instead of a manifest:

{
  "manifests": [
    {"digest": "sha256:abc...", "platform": {"architecture": "amd64"}},
    {"digest": "sha256:def...", "platform": {"architecture": "arm64"}}
  ]
}

One extra request to fetch the right platform's manifest. Still under 10KB.

Results

Approach	Data transferred
Pull all images	GBs (even with layer caching)
Metadata only	~500 KB (50 tags × ~10KB)

Try It

git clone https://github.com/jtodic/docker-time-machine.git
cd docker-time-machine
go mod download 
make build
make install

# Public images
./dtm registry nginx --last 20

# Private registries (after docker login)
./dtm registry your-registry.com/app --last 50 --format chart