Skip to content
OPS // KITitspentest.sh

E-DIV

Dive

Explores a container image layer by layer to find secrets, bloat, or misconfigurations baked into the build.

Official siteBack to catalog

OVERVIEW

Dive (github.com/wagoodman/dive) is a terminal UI for exploring a container image one layer at a time, showing exactly which files were added, modified, or removed at each build step, alongside a running efficiency score for wasted space. Because a Dockerfile `RUN rm secret.key` removes the file from the final visible filesystem but not from the image itself, a layer-by-layer view is often the only way to find a credential, private key, or `.env` file that a build accidentally baked in and then "deleted" in a later step.

It works against any local image or OCI tarball without needing a running daemon connection beyond pulling the image, and its CI mode (`dive --ci`) can gate a pipeline on image efficiency thresholds, but the pentest-relevant use is almost always the interactive layer explorer rather than the CI gate.

USE CASES

Practical use cases

  • 01

    Walking layer-by-layer through an image to find secrets deleted in a later `RUN` step but still present in an earlier layer.

  • 02

    Spotting unexpectedly large or unexplained files added during the build (cached credentials, debug tooling, source code).

  • 03

    Assessing whether a multi-stage build actually discarded build-time secrets from the final image.

  • 04

    Documenting image bloat or inefficiency as a supporting finding alongside a security issue.

QUICK START

Once you have a container image to review, to walk its layers interactively and spot what earlier build stages left behind.

  1. Confirm the image (and any registry credentials needed to pull it) is in scope for review.
  2. Install Dive and point it at a local image or a tag pullable from a reachable registry.
  3. Navigate layer by layer, reviewing the file tree diff for each one for unexpected additions or leftover files.
  4. Flag anything found (secrets, keys, source) and check whether it is reachable in the final running container, not just the image history.
dive target-image:latest

BEFORE YOU RUN IT

What to check before running it

Any credential, key, or token surfaced in a layer must be handled per the engagement's data-handling rules — treat it as live sensitive data, not just a code-quality note.

A secret found in an image layer may already be rotated or unused in production; confirm validity before reporting it as an active exploitable credential.

Dive reads the image locally — pulling a large or private image still requires registry access/credentials scoped to the engagement.

KEEP EXPLORING

View the whole phase →