dive: Fail the Build on Image Efficiency
dive with CI=true checks an image against efficiency and wasted-space rules, failing the build when it is too bloated.
Beyond inspection, dive can gate. Set thresholds for the minimum efficiency and the maximum wasted space, and dive exits non-zero when an image violates them.
What it does
When CI=true, dive runs headless and evaluates three rules: a minimum efficiency score (lowestEfficiency), a maximum wasted-bytes budget (highestWastedBytes), and a maximum wasted-percent (highestUserWastedPercent). Any rule that fails makes dive exit non-zero. Rules come from env vars or a .dive-ci config file.
Common usage
CI=true dive myorg/app:ci
# tighten the thresholds via env vars
CI=true \
DIVE_LOWESTEFFICIENCY=0.95 \
DIVE_HIGHESTWASTEDBYTES=20MB \
DIVE_HIGHESTUSERWASTEDPERCENT=0.10 \
dive myorg/app:ci
# or via a .dive-ci file
dive myorg/app:ci --ci-config .dive-ciOptions
| Rule / flag | What it does |
|---|---|
| lowestEfficiency | Minimum acceptable efficiency score (0-1) |
| highestWastedBytes | Maximum wasted bytes allowed (e.g. 20MB) |
| highestUserWastedPercent | Maximum fraction of wasted space (0-1) |
| --ci-config <file> | Path to a .dive-ci rules file |
| CI=true | Enable headless CI mode |
In CI
Commit a .dive-ci with your thresholds so they are reviewed, and run CI=true dive on the built image. Start lenient and tighten lowestEfficiency over time; a disabled rule is set to -1. Combine with a Trivy scan in the same job to cover both bloat and vulnerabilities.
Common errors in CI
The job fails with "Result:FAIL [Total:3] [Passed:2] [Failed:1]" naming the violated rule; loosen that threshold or slim the image. A rule that never trips is likely set to -1 (disabled) in .dive-ci. The same no-daemon error as plain dive applies; supply a docker-archive:// or podman:// source.