Medical Image Batch Conversion Toolkit (Container Edition)

Health & Fitness

Converts DICOM (the medical imaging standard file format) files in bulk into PNGs, a CSV/JSON index and an offline gallery page; native greyscale frames are compressed into 8-bit PNGs using the window/level parameters inside the file or an automatic stretch, and the index states which of the two was used for each image; a file truncated inside its pixel data is stopped by the integrity check and returns a non-zero exit code. A derivative built on a pure Go DICOM parsing library, MIT licensed, with Traditional Chinese documentation.

Subscribe & download See how to start

SubscriptionUS$49 per month

Last run2026-11-02

In practice

Readiness4 / 5

What you need

Few changes needed5 / 5

Who it is for

People who need a batch of DICOM files turned quickly into something they can look at and search: data pre-processing for research or engineering teams (converting to PNG to feed a downstream ML model or a web page), support staff spot-checking the contents of a file, and teaching demonstrations. The appeal is that neither Go nor DCMTK has to be installed — Docker alone gets you the PNGs, the index and the gallery page, and the index states which window each image used and which files failed to convert. It is not viewing software, and it does not de-identify.

How to start

$ docker compose run --rm demo
$ docker compose run --rm convert

Browse the files

Files in the product repository at the pinned commit. A few house files are left out of the zip.

File overview88 paths

▸cmd1

dicomutil/

▸docs1

UPSTREAM-README.md

▸fuzz1

dicom_fuzz_test.go

▸in1

README.md

▸internal13

batch/
cli/
convert/
windowing/

▸pkg37

charset/
dcmtime/
debug/
dicomio/
frame/
personname/
tag/
uid/
vrraw/

▸testdata8

1.dcm
2.dcm
3.dcm
4.dcm
5.dcm
6.dcm
data_details.md
included_licenses.md

▫ATTRIBUTION.md

▫Dockerfile

▫LICENSE

▫Makefile

▫PRODUCT.md

▫README.md

▫SECURITY.md

▫compose.yaml

▫dataset.go

▫dataset_test.go

▫delivery-manifest.txt

▫element.go

▫element_test.go

▫go.mod

▫go.sum

▫parse.go

▫parse_internal_test.go

▫parse_test.go

▫read.go

▫read_test.go

▫write.go

▫write_test.go

▫Config and hidden files 4

Latest passing run

Clone → Checkout → Toolchain → Build → Run batch → Unit tests → Docker demo

Pre-purchase Disclosure

What you are buying

A containerised command line tool for converting DICOM (the standard file format for medical images) files in bulk: it converts a whole batch into PNG images, a CSV and a JSON index, and an HTML gallery page that opens offline; greyscale images are compressed into 8-bit PNGs using the window parameters inside the file or an automatic stretch, and the index states which of the two was used for each image.

Derived from an MIT-licensed pure Go DICOM parsing library; the batch mode, the window handling, the integrity check, the container orchestration and the Traditional Chinese documentation are ours. Delivery is a frozen snapshot: one zip file, taken from the product repository at revision 71f9481.

Known limitations

Output is written into the out directory on the host, and each run overwrites files of the same name; the index and the gallery page reflect only the most recent run
On Linux the container runs as root by default, so the files produced in the out directory are owned by root
The first run fetches over the network: it pulls the Go compiler and the distroless base image, and fetches the dependency modules while building
No clinical use and no regulatory conformity are promised
It does not de-identify: the JSON output carries the patient and study tags out of the file as they are
It is not viewing software; there is no interactive viewing, measurement or annotation
Of the compressed transfer syntaxes, only those the Go standard JPEG decoder can handle convert; the rest are recorded as error in the index
Pinned to the delivered snapshot; it does not follow upstream.

The liability cap, the scope of what is promised and the statutory floor are governed by the Terms of Service.

Vetting record

Everything below was checked against the pinned commit 8ae5137. Every verdict carries its full reasoning, an evidence link and the checker; failures are published, not hidden — do not take our word for it, verify it yourself.

5 PASS0 WARN0 FAIL

Source ReviewPASS

Every non-test Go source file was read through (parse / read / write / element / dataset, cmd/dicomutil, and under pkg the dicomio, frame, tag, uid, charset, debug, vrraw, dcmtime and personname packages) along with the Makefile, go.mod, go.sum, the three GitHub workflows, the README and the explanatory files in testdata; the test files were scanned for imports and dangerous patterns. What it contains is exactly a parser and writer for the DICOM binary format: the imports are only the standard library plus x/text (character sets), x/exp (generic constraints) and go-cmp (tests only); grepping the whole tree finds no net, no net/http, no os/exec, no syscall and no unsafe. The only writes through os are the CLI emitting pixel frames as PNG or JPG, and temporary files in the tests. The tag definition table in pkg/tag is a machine-generated pure data table, and the Python script that generates it runs only when a maintainer runs it by hand — neither go build nor go test executes it. An observation (not a defect): the reading side allocates its buffer straight from the length declared inside the file, so a maliciously constructed file can induce a large memory allocation — that is common for parsers, upstream has fuzz tests, and it is listed here so the buyer knows.

Script SafetyPASS

Every executable script was read through: the Makefile (build / test / bench / release targets, where release only does a multi-platform go build and packaging, and bench-diff switches to the main line and back), the three GitHub workflows (one builds and tests, the other two run benchmarks and will reset and check out a baseline commit — they run only in upstream's CI, not in this shop's health check), and the Python script in pkg/tag that generates the tag definition table. Grepping the whole tree for dangerous patterns (rm -rf, curl, piping into sh, eval, sudo, token, secret, credential, api key, password, base64, chmod) produced no hits; wget appears only in the explanatory text of the README, telling the user to download a prebuilt binary from a third-party redirect service — that is documentation, not code, and neither this shop's health check nor the delivery goes down that path (the health check does a go build from source). The outbound connection surface, listed as it is: go build and go test fetch three dependencies through the module proxy (go.sum pins the checksums); upstream's CI installs benchstat and Go; the script that generates the tag table downloads the standard file, and only when run by hand; and that download link in the README is documentation. The program itself makes no network connection at runtime.

RecencyPASS

At the time of vetting (2026) upstream was not archived; the pinned commit 8ae5137 was the main line's HEAD at that time, and its commit date was no more than 90 days from the day of vetting. An honest footnote: main-line commits were sparse, so this only means there was a recent commit, not that it was active. This product is frozen and does not follow upstream.

LicensePASS

SPDX:MIT

The LICENSE at the root of the repository (21 lines) is the standard full MIT text, Copyright (c) 2020 Suyash Kumar; gh api repos/suyashkumar/dicom/license returns spdx_id=MIT and path=LICENSE; the README carries no extra terms contradicting the LICENSE. MIT permits commercial use, redistribution and sublicensing, on condition that the copyright and licence notice are retained — the buyer zip is the whole tree at the pinned commit, and the LICENSE is inside it. Note the README at line 77: it states that v0 was a hard fork of gillesdemey/go-dicom and that v1 has been rewritten from scratch; the LICENSE at the pinned commit names only Suyash Kumar and does not carry a separate copyright line for the original go-dicom project — that is upstream's own attribution question, it does not affect MIT's redistributability for this shop, and it is recorded here as it is.

Dependency LicensesPASS

Program dependencies (go.mod, each looked up for its spdx): go-cmp, golang.org/x/exp and golang.org/x/text are all BSD-3-Clause, and the rest is the Go standard library. Embedded data: the tag definition table in pkg/tag is derived from innolitics/dicom-standard (MIT, with its licence reproduced in full in the file header); the UID table in pkg/uid states that it is translated from pynetdicom (MIT) but does not reproduce its licence notice. The six test images delivered with the snapshot were each checked one by one: four come from The Cancer Imaging Archive, resolved through their DOIs to their collection pages, whose licence field reads CC BY 3.0 or 4.0; the other two come from cornerstonejs/dicomParser, whose blob hashes were compared locally and match the original files, and that project is MIT. The attribution text and the DOIs have been written into the product repository's ATTRIBUTION.md and are delivered with the zip. Not verified: whether the four TCIA images are bit-for-bit identical to the originals (TCIA does not publish per-file hashes).