wagoodman/dive · error

evaluation failed

Error message

evaluation failed

What it means

Thrown at the end of a `dive --ci` run when the configured CI rules evaluated against the image analysis did not all pass (eval.Pass == false). It is not an internal failure: the analysis completed, the report was already published via bus.Report, and this error exists purely to make the dive process exit non-zero so CI pipelines fail. The detailed per-rule results (which thresholds were breached) are printed to the report output before the error is returned.

Source

Thrown at cmd/dive/cli/internal/command/root.go:91

func run(ctx context.Context, opts options.Application, img *image.Image, content image.ContentReader) error {
	analysis, err := adapter.NewAnalyzer().Analyze(ctx, img)
	if err != nil {
		return fmt.Errorf("cannot analyze image: %w", err)
	}

	if opts.Export.JsonPath != "" {
		if err := adapter.NewExporter(afero.NewOsFs()).ExportTo(ctx, analysis, opts.Export.JsonPath); err != nil {
			return fmt.Errorf("cannot export analysis: %w", err)
		}
		return nil
	}

	if opts.CI.Enabled {
		eval := adapter.NewEvaluator(opts.CI.Rules.List).Evaluate(ctx, analysis)

		if !eval.Pass {
			return errors.New("evaluation failed")
		}
		return nil
	}

	bus.ExploreAnalysis(*analysis, content)

	return nil
}

View on GitHub (pinned to d6c691947f)

Solutions

1. Read the CI report output above the error to see which rule(s) failed and by how much
2. Fix the Dockerfile: merge RUN steps that add and remove files in the same layer, drop caches (rm -rf /var/lib/apt/lists/*), remove duplicated files across layers
3. If the threshold is intentionally strict for new images, tune the rule values in the CI config file (e.g. .dive-ci) to realistic levels
4. Disable a rule you do not want enforced by setting its config value to the disabled sentinel instead of deleting analysis steps

Example fix

# before
FROM ubuntu
RUN apt-get update && apt-get install -y curl
RUN rm -rf /var/lib/apt/lists/*

# after (add/remove in one layer, no wasted bytes)
FROM ubuntu
RUN apt-get update && apt-get install -y curl && rm -rf /var/lib/apt/lists/*

# pre-check thresholds before enforcing the gate
dive myimage:latest --json /tmp/dive.json
# inspect efficiencyScore / wastedBytes in the JSON, compare to your thresholds, then decide

# in a CI script: treat exit!=0 as gate failure, but read the report first
dive myimage:latest --ci || { echo 'dive CI gate failed — see report above'; exit 1; }

When it happens

Trigger: Running `dive <image> --ci` (or with ci.enabled in config) where at least one of lowestEfficiencyThreshold, highestWastedBytes, or highestUserWastedPercent rules fails: e.g. image efficiency below 0.9, wasted bytes above 1GB, or user-wasted percent above 0.1 with defaults enabled.

Common situations: A Dockerfile regression adds duplicated files across layers (apt caches left behind, COPY of files later deleted), dropping image efficiency below the configured threshold in a CI gate; or a team tightens thresholds in .dive-ci without rebuilding base images that never met them.

Related errors

• failed evaluation
• invalid %s config value, given %q: %v
• %s config value is outside allowed range (0-1), given '%f'
• invalid highestWastedBytes config value, given %q: %v
• invalid highestUserWastedPercent config value, given %q: %v

AI-assisted analysis of wagoodman/dive@d6c691947f (2026-08-15). Data as JSON: /api/errors/54e68d3b92d792d3. Report an issue: GitHub.