Bash script to diff 2 container images

diff-container-images.sh

#!/bin/bash

# This script diffs the content of two container images
# USAGE: ./diff-container-images.sh <registry>/<repo> <tag1> <tag2>

# strict mode
set -euo pipefail

registry_repo=$1
tag1=$2
tag2=$3

function extract {
    # Use subshell to trigger cleanup on exit
    (
        tag=$1
        export_dir=$2
        full_image=${registry_repo}:${tag}
        container_name=${registry_repo##*/}-${tag}
        echo "⬇️ Pulling image ${full_image}" >&2
        docker pull --quiet ${full_image} > /dev/null
        echo "📦 Exporting image contents to ${export_dir}" >&2
        docker create --name ${container_name} ${full_image} > /dev/null
        # Set up a trap to remove the container on exit
        trap "echo '🧹 Cleaning up docker container ${container_name}'; docker rm ${container_name} > /dev/null" EXIT
        mkdir -p ${export_dir}
        docker export ${container_name} | tar xf - -C ${export_dir}
    )
}

export_dir1=$(mktemp -d)
export_dir2=$(mktemp -d)
extract ${tag1} ${export_dir1}
extract ${tag2} ${export_dir2}

diff_result=$(mktemp --tmpdir --suffix=.diff container_image_XXXXXX)

echo "🔍 Diffing image contents" >&2
(diff --color=auto --no-dereference --unified -r ${export_dir1} ${export_dir2} || true) \
    | sed -e "s|${export_dir1}|${tag1}|g;s|${export_dir2}|${tag2}|g" \
          -e "s|^diff .* ${tag1}/.* ${tag2}/.*$||" > ${diff_result}

echo "📊 Diff summary saved to ${diff_result}" >&2