Docker save only non public layers

The docker-save-last-layer command line utility combined with docker build --squash is made to accomplish exactly this.

It exports only the last layer of the specified docker image.

It works by using a patched version of the docker daemon inside a docker image that can access the images on your host machine. So it doesn't require doing a full docker save before using it like the undocker answer. This makes it much more performant for large base images.

Typical usage is simple and looks like:

pip install d-save-last

docker build --t myimage --squash .
d-save-last myimage -o ./myimage.tar

You can try undocker. The tool can extract all or part of the layers of a Docker image onto the local filesystem. You can extract one or more specific layers:

$ docker save busybox |
  undocker -vi -o busybox -l ea13149945cb6b1e746bf28032f02e9b5a793523481a0a18645fc77ad53c4ea2
INFO:undocker:extracting image busybox (4986bf8c15363d1c5d15512d5266f8777bfba4974ac56e3270e7760f6f0a8125)
INFO:undocker:extracting layer ea13149945cb6b1e746bf28032f02e9b5a793523481a0a18645fc77ad53c4ea2

Of course, it doesn't automatically sort out publicly available layers, but this is something you can start with, here is the tool intro article by original author.