Image Size Optimization

Why Size Matters

Image size directly affects pull time, startup speed, storage costs, and attack surface. A 2GB image takes minutes to pull across a network and stores unnecessary files. A 20MB image pulls in seconds, starts instantly, and contains only what is needed. Smaller images are faster, cheaper, and more secure.

Measuring Size

# List all images with sizes
docker image ls

# Compact format
docker image ls --format "table {{.Repository}}	{{.Tag}}	{{.Size}}"

# Show image size in human-readable format
docker image inspect myapp --format '{{.Size}}'

# Show the virtual size (all layers including base)
docker image inspect myapp --format '{{.VirtualSize}}'

Reducing Base Image Size

The base image is often the largest contributor to total image size. Switching from ubuntu to alpine or distroless can reduce your image by hundreds of megabytes. Start every optimization by evaluating whether you need a full distribution.

Removing Caches

Package managers leave caches, logs, and metadata after installation. These files are useful during the build but waste space in the final image. Clean them in the same RUN instruction that installs packages to avoid keeping them in a previous layer.

# Bad — cache persists in the RUN layer
RUN apt-get update
RUN apt-get install -y curl
# apt cache is still in the image

# Good — clean in the same layer
RUN apt-get update && \
    apt-get install -y --no-install-recommends curl && \
    rm -rf /var/lib/apt/lists/*

# Good — use --no-cache for apk
RUN apk add --no-cache curl

Using dive

dive is a tool that lets you explore every layer of a Docker image, showing which files were added, modified, or deleted in each layer. It reveals hidden bloat — files you did not realize were in the image.

# Install dive
brew install dive  # macOS
# or
docker pull wagoodman/dive

# Analyze an image
dive myapp:latest

# Analyze during build
CI=true dive myapp:latest

# In the TUI:
# - Arrow keys navigate layers
# - Tab toggles file details
# - Space marks files for analysis

.dockerignore Optimization

Files excluded by .dockerignore are never sent to the build context, but files included in the context may still end up in the image if your COPY instructions are too broad. A well-crafted .dockerignore prevents accidental inclusion of unnecessary files.

# Version control
.git
.gitignore

# Dependencies
node_modules
vendor
__pycache__

# Build output
dist
build
target

# Development
.env
.env.*
*.log
coverage
.nyc_output

# IDE
.vscode
.idea
*.swp

# Docker files
Dockerfile*
docker-compose*.yml

# Documentation
*.md
LICENSE