wagoodman/dive · critical

cannot load image: %w

Error message

cannot load image: %w

What it means

Returned by `dive <image>` when the resolved provider fails to fetch the image reference into an analyzable form (adapter.ImageResolver(...).Fetch). It wraps the engine-level error: image not found locally/remote, registry auth failures, network errors, or unsupported image formats/manifests the resolver cannot process.

Source

Thrown at cmd/dive/cli/internal/command/root.go:55

			}
			opts.Analysis.Image = args[0]
			return nil
		},
		RunE: func(cmd *cobra.Command, _ []string) error {
			if err := setUI(app, opts.Application); err != nil {
				return fmt.Errorf("failed to set UI: %w", err)
			}

			resolver, err := dive.GetImageResolver(opts.Analysis.Source)
			if err != nil {
				return fmt.Errorf("cannot determine image provider to fetch from: %w", err)
			}

			ctx := cmd.Context()

			img, err := adapter.ImageResolver(resolver).Fetch(ctx, opts.Analysis.Image)
			if err != nil {
				return fmt.Errorf("cannot load image: %w", err)
			}

			return run(ctx, opts.Application, img, resolver)
		},
	}, opts)
}

func setUI(app clio.Application, opts options.Application) error {
	type Stater interface {
		State() *clio.State
	}

	state := app.(Stater).State()

	ux := ui.NewV1UI(opts.V1Preferences(), os.Stdout, state.Config.Log.Quiet, state.Config.Log.Verbosity)
	return state.UI.Replace(ux)
}

View on GitHub (pinned to d6c691947f)

Solutions

1. Read the wrapped error — it distinguishes not-found, auth, and network causes
2. docker pull / podman pull the image manually to verify it exists and credentials work
3. Ensure --source matches the engine that actually holds the image
4. docker login (or podman login) for private registries; check proxy/DNS in restricted networks

Example fix

# before (image lives in podman, source defaults elsewhere)
dive localhost/myapp:latest

# after
dive localhost/myapp:latest --source podman

# make the image locally available before analyzing
 docker image inspect "$IMG" >/dev/null 2>&1 || docker pull "$IMG" || exit 1
dive "$IMG"

img, err := adapter.ImageResolver(resolver).Fetch(ctx, ref)
if err != nil {
    if isTransient(err) { // network/registry timeouts: backoff and retry once
        time.Sleep(2 * time.Second)
        img, err = adapter.ImageResolver(resolver).Fetch(ctx, ref)
    }
    if err != nil { return fmt.Errorf("cannot load image: %w", err) }
}

When it happens

Trigger: dive nonexistent-image (not local, not pullable); private registry image without docker login; registry unreachable behind a proxy; local image saved in a format the resolver cannot read (e.g. OCI layout quirks or containerd-shuffled storage); typo'd tag.

Common situations: CI without registry credentials pulling a private base image; air-gapped environments where the implicit pull fails; images built by a different engine than the selected --source (image exists in podman but --source docker).

Related errors

• no results returned
• cannot determine image provider for build: %w
• cannot build image: %w
• cannot determine image provider to fetch from: %w
• cannot analyze image: %w

AI-assisted analysis of wagoodman/dive@d6c691947f (2026-08-15). Data as JSON: /api/errors/87ce13395cef6f71. Report an issue: GitHub.