E-DIV
Dive
Explores a container image layer by layer to find secrets, bloat, or misconfigurations baked into the build.
OVERVIEW
Dive (github.com/wagoodman/dive) is a terminal UI for exploring a container image one layer at a time, showing exactly which files were added, modified, or removed at each build step, alongside a running efficiency score for wasted space. Because a Dockerfile `RUN rm secret.key` removes the file from the final visible filesystem but not from the image itself, a layer-by-layer view is often the only way to find a credential, private key, or `.env` file that a build accidentally baked in and then "deleted" in a later step.
It works against any local image or OCI tarball without needing a running daemon connection beyond pulling the image, and its CI mode (`dive --ci`) can gate a pipeline on image efficiency thresholds, but the pentest-relevant use is almost always the interactive layer explorer rather than the CI gate.
USE CASES
Practical use cases
- 01
Walking layer-by-layer through an image to find secrets deleted in a later `RUN` step but still present in an earlier layer.
- 02
Spotting unexpectedly large or unexplained files added during the build (cached credentials, debug tooling, source code).
- 03
Assessing whether a multi-stage build actually discarded build-time secrets from the final image.
- 04
Documenting image bloat or inefficiency as a supporting finding alongside a security issue.
QUICK START
Once you have a container image to review, to walk its layers interactively and spot what earlier build stages left behind.
- Confirm the image (and any registry credentials needed to pull it) is in scope for review.
- Install Dive and point it at a local image or a tag pullable from a reachable registry.
- Navigate layer by layer, reviewing the file tree diff for each one for unexpected additions or leftover files.
- Flag anything found (secrets, keys, source) and check whether it is reachable in the final running container, not just the image history.
dive target-image:latestBEFORE YOU RUN IT
What to check before running it
Any credential, key, or token surfaced in a layer must be handled per the engagement's data-handling rules — treat it as live sensitive data, not just a code-quality note.
A secret found in an image layer may already be rotated or unused in production; confirm validity before reporting it as an active exploitable credential.
Dive reads the image locally — pulling a large or private image still requires registry access/credentials scoped to the engagement.