Technology · Ebook

Eraser: Cleaning Vulnerable Images Off Kubernetes Nodes

by Shriira Press

Eraser is a CNCF sandbox project that solves a problem most clusters develop without noticing: pipelines constantly push images onto nodes, but almost nothing cleans them up, leaving unused, often-vulnerable images hoarding disk where the kubelet's own garbage collector — which only weighs disk pressure — will never touch them. Eraser enumerates every non-running image on every node, optionally scans each with Trivy, and removes the ones that are both unused and unsafe, manually via an ImageList resource or automatically on a timer. This free book builds the model piece by piece: the ImageList CRD, the controller and ImageJob that fan work to every node, the collector-scanner-remover pipeline, Trivy-based scanning, and scheduling, exclusions, and node filters — seven focused chapters with clear diagrams.

Contents

1. 1Preface
2. 2Chapter 1 — What Eraser Is
3. 3Chapter 2 — The ImageList and Manual Removal
4. 4Chapter 3 — Controller, ImageJob, and the Node Pods
5. 5Chapter 4 — The Collector–Scanner–Remover Pipeline
6. 6Chapter 5 — Vulnerability Scanning with Trivy
7. 7Chapter 6 — Scheduling, Configuration, and Exclusions
8. 8Chapter 7 — Eraser in Practice