layer-blame is git blame for image layers — it names the package responsible for every byte.

Here's what it prints when you point it at a stock Alpine image:

$ docker save alpine:3.20 -o alpine.tar

$ layer-blame alpine.tar

Image total: 8.4 MB across 1 layers · package attribution: 100%