Deleting a file makes the image bigger

If a layer records what changed, what does it record when you delete something? It cannot remove the bytes: those are in a layer below, and layers below are immutable — other images may be sharing them.

So it records a marker. A whiteout is an entry that says: whatever the layers beneath me put at this path, hide it. The file disappears from the filesystem a container sees. The bytes stay exactly where they were, in a layer that is still in the image, still in the registry, and still readable by anyone who pulls it and unpacks that layer by hand.

A whiteout costs a tar header and no content — 512 bytes. So deleting a four-hundred-megabyte file adds 512 bytes to your image and removes nothing from it.

This is not a size problem with a security footnote. It is a security problem that happens to show up in the size column.