SlimToolkit: Minify and Harden Your Container Images
Shriira Press
How a single tool watches your container run, throws away everything it never touches, and hands you an image up to thirty times smaller and far harder to attack.
Welcome to SlimToolkit: Minify and Harden Your Container Images.
SlimToolkit, formerly known as DockerSlim, is a free and open-source CNCF sandbox project that inspects, minifies, and secures container images without asking you to change a single line of your application or your Dockerfile. The problem it solves is one almost every team eventually meets: container images grow fat with package managers, shells, build tools, and libraries that the running application never actually uses, and every one of those unused files is both wasted bytes and extra attack surface. SlimToolkit attacks that bloat by combining static analysis of the image with dynamic analysis that runs the container and watches what it really touches, then builds a new image containing only what was needed. This book walks through the whole journey: why images bloat in the first place, what SlimToolkit is and how it fits the cloud-native ecosystem, the dual-process engine of master and sensor that drives its analysis, the build command that produces a slim image, the xray and lint commands for inspecting and auditing, the automatic generation of seccomp and AppArmor security profiles, and finally how to fold all of this into real CI pipelines and daily workflows.
This title is part of the ShriIra library and is free to read in full, right here — our small contribution to making world-class knowledge easy to reach.
A note on reading it: open the Contents menu at the top of the reader to jump between chapters, use the Aa menu to set a comfortable text size, theme (light, sepia, or night), and single- or two-page layout. Your place is saved automatically, so you can always pick up where you left off.
We hope it serves you well.
— Shriira Press