Old container images pile up on your nodes, quietly hoarding disk and carrying known vulnerabilities. Eraser finds the ones nobody is running and sweeps them away — on a schedule or on demand.

Welcome to Eraser: Cleaning Vulnerable Images Off Kubernetes Nodes.

Eraser is a CNCF sandbox project that solves a problem most clusters develop without anyone noticing: pipelines constantly build and push images onto nodes, but almost nothing cleans them up. The images that remain are not running anything, yet they consume disk and often carry vulnerabilities that the kubelet's own garbage collector will never weigh, because it only evicts images when storage pressure crosses a threshold and never looks at their security state. Eraser closes that gap. It enumerates every non-running image on every node, optionally scans each one with Trivy, and removes the ones that are both unused and judged unsafe — manually through an ImageList resource, or automatically on a recurring timer. This free book teaches Eraser from the ground up: the bloat-and-vulnerability problem and what Eraser is, the ImageList custom resource for targeted removal, the controller and ImageJob machinery that fans work out to every node, the collector–scanner–remover pipeline that runs inside each node-local pod, how Trivy turns severity policy into deletion decisions, and how to configure scheduling, exclusions, and node filters before running it in production. Seven focused chapters with clear diagrams that make image hygiene concrete — so unused, vulnerable images stop accumulating while you sleep.

This title is part of the ShriIra library and is free to read in full, right here — our small contribution to making world-class knowledge easy to reach.

A note on reading it: open the Contents menu at the top of the reader to jump between chapters, use the Aa menu to set a comfortable text size, theme (light, sepia, or night), and single- or two-page layout. Your place is saved automatically, so you can always pick up where you left off.

We hope it serves you well.

— Shriira Press

Contents

1. Chapter 1 — What Eraser Is
2. Chapter 2 — The ImageList and Manual Removal
3. Chapter 3 — Controller, ImageJob, and the Node Pods
4. Chapter 4 — The Collector–Scanner–Remover Pipeline
5. Chapter 5 — Vulnerability Scanning with Trivy
6. Chapter 6 — Scheduling, Configuration, and Exclusions
7. Chapter 7 — Eraser in Practice