whybig
"Why is this so big?" — point it at a Docker image, a Python wheel, a model checkpoint, a JS bundle, or a git repo. Get a treemap plus ranked culprits and concrete fixes.
$ whybig api-image.tar --html report.html
whybig — api-image.tar
kind: docker-image total: 812.4 MB
layers: 14
Top culprits:
340.2 MB 41% root/.cache/pip
121.7 MB 14% usr/lib/python3.11/site-packages/torch
48.9 MB 6% app/.git
Findings (3, ~401.5 MB reclaimable):
[WB001] 340.2 MB pip cache shipped
340.2 MB of pip cache at root/.cache/pip
fix: pip install --no-cache-dir, or RUN --mount=type=cache,target=/root/.cache/pip
[WB004] 48.9 MB .git directory shipped
...
Zero dependencies, pure stdlib, Python 3.9+. Nothing is executed or unpickled — checkpoints are analyzed from their headers only.
Install
pip install whybig # or just copy the directory; it's stdlib-only
whybig <path> [--html report.html] [--json] [--kind KIND] [--top N]
What it understands
| Artifact | Detected by | What you learn |
|---|---|---|
| Docker image | docker save tar, OCI layout dir |
merged layer tree, per-layer sizes + commands, bytes shadowed by later layers |
| Python wheel | .whl |
compressed size per file, package metadata |
| Model checkpoint | .safetensors, .gguf, .pt/.pth/.ckpt |
per-tensor sizes, dtype breakdown, optimizer-state detection |
| JS bundle | .js/.mjs/.cjs + source map |
generated bytes attributed back to original source files |
| Git repo | dir with .git |
on-disk (packed) weight of all history per path, HEAD vs history-only |
| dir / archive | fallback | plain size tree, generic rules still apply |
--html writes a self-contained treemap (no CDN, works offline, dark/light):
click to zoom, breadcrumb to go back, findings listed below the map.
Rules
| Rule | Finds | Fix it suggests |
|---|---|---|
| WB001 | pip cache shipped | --no-cache-dir / BuildKit cache mount |
| WB002 | apt lists/cache shipped | rm -rf /var/lib/apt/lists/* in same RUN |
| WB003 | __pycache__ / .pyc |
PYTHONDONTWRITEBYTECODE=1, ignore files |
| WB004 | .git inside artifact |
.dockerignore, multi-stage |
| WB005 | tests inside wheel | package exclude = ["tests*"] |
| WB006 | files duplicated across layers | merge RUN/COPY steps, multi-stage |
| WB007 | float32-dominated checkpoint | bf16/fp16 or quantize |
| WB008 | optimizer state in checkpoint | save state_dict() only |
| WB009 | source maps in prod | build without maps / hidden maps |
| WB010 | node_modules shipped |
npm ci --omit=dev |
| WB011 | large blobs in git history only | git filter-repo / LFS |
| WB012 | static libs (.a) in runtime image |
drop -dev packages from final stage |
Contributing
The contributor unit is deliberately small:
- One analyzer per artifact type —
whybig/analyzers/<type>.pyexposingKINDandanalyze(path) -> Report. Register it inanalyzers/__init__.pyanddetect.py. Wanted:.deb/.rpm,.apk(Android),.jar, ONNX, conda envs, npm packages. - One size heuristic per rule —
whybig/rules/<name>.pyexposingRULE(next freeWBnnn),TITLE,APPLIES(set of kinds), andcheck(report) -> [Finding]. Auto-discovered; no registration needed. Wanted: locales/i18n data, condapkgs/cache,.DS_Store/thumbnail litter, debug symbols in.so, duplicate vendored deps.
Every rule needs a test that builds its fixture programmatically (see
tests/) — no binary fixtures in the repo.
python3 -m pytest tests/ -q
License
Metadata
Release files for whybig 0.1.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| whybig-0.1.0.tar.gz | 24.7 kB | With provenance | Details for whybig-0.1.0.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| whybig-0.1.0-py3-none-any.whl | Python 3 | none | any | Details for whybig-0.1.0-py3-none-any.whl |
Total release size: 52.7 kB
Release files / whybig-0.1.0.tar.gz
| Download URL | whybig-0.1.0.tar.gz |
|---|---|
| Size | 24.7 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
5f85058cab8d251ccf31588d3cc4dab58ee676d5724b95c35d847b8fa5487355
|
|
BLAKE2b-256 checksum How to use checksums |
e0bd636e908959bd487f5cedb3e49d78bafdd0d522cb1cf179dba7570108bf24
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 9, 2026.
Transparency logRelease files / whybig-0.1.0-py3-none-any.whl
| Download URL | whybig-0.1.0-py3-none-any.whl |
|---|---|
| Size | 28.1 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
bd4dd1b681f228ab644dacd84829ae494f8a1834ae4723c44041b2002e890f39
|
|
BLAKE2b-256 checksum How to use checksums |
97276183a6b91bef0f3ce0760c4d11ed1cd0972ca0df10db44edc0c918529539
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 9, 2026.
Transparency logSecurity for whybig 0.1.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for whybig-0.1.0.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 9, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.