Skip to main content

whybig

CI PyPI Python License: MIT

"Why is this so big?" — point it at a Docker image, a Python wheel, a model checkpoint, a JS bundle, or a git repo. Get a treemap plus ranked culprits and concrete fixes.

$ whybig api-image.tar --html report.html

whybig — api-image.tar
kind: docker-image   total: 812.4 MB
layers: 14

Top culprits:
    340.2 MB   41%  root/.cache/pip
    121.7 MB   14%  usr/lib/python3.11/site-packages/torch
     48.9 MB    6%  app/.git

Findings (3, ~401.5 MB reclaimable):
  [WB001]   340.2 MB  pip cache shipped
           340.2 MB of pip cache at root/.cache/pip
           fix: pip install --no-cache-dir, or RUN --mount=type=cache,target=/root/.cache/pip
  [WB004]    48.9 MB  .git directory shipped
           ...

Zero dependencies, pure stdlib, Python 3.9+. Nothing is executed or unpickled — checkpoints are analyzed from their headers only.

Install

pip install whybig        # or just copy the directory; it's stdlib-only
whybig <path> [--html report.html] [--json] [--kind KIND] [--top N]

What it understands

Artifact Detected by What you learn
Docker image docker save tar, OCI layout dir merged layer tree, per-layer sizes + commands, bytes shadowed by later layers
Python wheel .whl compressed size per file, package metadata
Model checkpoint .safetensors, .gguf, .pt/.pth/.ckpt per-tensor sizes, dtype breakdown, optimizer-state detection
JS bundle .js/.mjs/.cjs + source map generated bytes attributed back to original source files
Git repo dir with .git on-disk (packed) weight of all history per path, HEAD vs history-only
dir / archive fallback plain size tree, generic rules still apply

--html writes a self-contained treemap (no CDN, works offline, dark/light): click to zoom, breadcrumb to go back, findings listed below the map.

Rules

Rule Finds Fix it suggests
WB001 pip cache shipped --no-cache-dir / BuildKit cache mount
WB002 apt lists/cache shipped rm -rf /var/lib/apt/lists/* in same RUN
WB003 __pycache__ / .pyc PYTHONDONTWRITEBYTECODE=1, ignore files
WB004 .git inside artifact .dockerignore, multi-stage
WB005 tests inside wheel package exclude = ["tests*"]
WB006 files duplicated across layers merge RUN/COPY steps, multi-stage
WB007 float32-dominated checkpoint bf16/fp16 or quantize
WB008 optimizer state in checkpoint save state_dict() only
WB009 source maps in prod build without maps / hidden maps
WB010 node_modules shipped npm ci --omit=dev
WB011 large blobs in git history only git filter-repo / LFS
WB012 static libs (.a) in runtime image drop -dev packages from final stage

Contributing

The contributor unit is deliberately small:

  • One analyzer per artifact type — whybig/analyzers/<type>.py exposing KIND and analyze(path) -> Report. Register it in analyzers/__init__.py and detect.py. Wanted: .deb/.rpm, .apk (Android), .jar, ONNX, conda envs, npm packages.
  • One size heuristic per rule — whybig/rules/<name>.py exposing RULE (next free WBnnn), TITLE, APPLIES (set of kinds), and check(report) -> [Finding]. Auto-discovered; no registration needed. Wanted: locales/i18n data, conda pkgs/ cache, .DS_Store/thumbnail litter, debug symbols in .so, duplicate vendored deps.

Every rule needs a test that builds its fixture programmatically (see tests/) — no binary fixtures in the repo.

python3 -m pytest tests/ -q

License

MIT

Metadata

Release files for whybig 0.1.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for whybig 0.1.0
File Size Uploaded Provenance Actions
whybig-0.1.0.tar.gz 24.7 kB With provenance Details for whybig-0.1.0.tar.gz

Built distribution (wheel)

Table of built distributions (wheels) for whybig 0.1.0
File Interpreter ABI Platform Actions
whybig-0.1.0-py3-none-any.whl Python 3 none any Details for whybig-0.1.0-py3-none-any.whl

Total release size: 52.7 kB

Release files / whybig-0.1.0.tar.gz

Download URL whybig-0.1.0.tar.gz
Size 24.7 kB
Tags Source
SHA-256 checksum
How to use checksums
5f85058cab8d251ccf31588d3cc4dab58ee676d5724b95c35d847b8fa5487355
BLAKE2b-256 checksum
How to use checksums
e0bd636e908959bd487f5cedb3e49d78bafdd0d522cb1cf179dba7570108bf24
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.14

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Aug 9, 2026.

Transparency log

Release files / whybig-0.1.0-py3-none-any.whl

Download URL whybig-0.1.0-py3-none-any.whl
Size 28.1 kB
Tags Python 3
SHA-256 checksum
How to use checksums
bd4dd1b681f228ab644dacd84829ae494f8a1834ae4723c44041b2002e890f39
BLAKE2b-256 checksum
How to use checksums
97276183a6b91bef0f3ce0760c4d11ed1cd0972ca0df10db44edc0c918529539
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.14

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Aug 9, 2026.

Transparency log

Security for whybig 0.1.0

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

Full provenance

All 2 files in this release have been uploaded with provenance metadata.

Select from 2 files

Attestation for whybig-0.1.0.tar.gz

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Aug 9, 2026.

Transparency log

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

To learn more about protecting yourself from malicious actors, visit our package security documentation.

Release history Release notifications | RSS feed

This release

0.1.0 This release

2 release files Full provenance

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page