slimtoolkit/slim

Slim is a free and open-source project that optimizes and secures container images by understanding your application and what it needs. It simplifies and improves the developer experience when building, customizing, and using containers. Slim allows developers to inspect, optimize, and debug their containers using various commands such as xray, lint, build, debug, run, images, merge, registry, and vulnerability. It makes containers better, smaller, and more secure while providing advanced visibility and improved usability.

Slim supports various container tools and runtimes in the cloud native ecosystem, including Docker, and is now a CNCF Sandbox project. It was created by Kyle Quest and has been improved by many contributors. The project is supported by Slim.AI.

Slim allows you to optimize images without changing anything in them, reducing their size by up to 30x while maintaining security. It also helps you understand and author better container images. You don’t need to change your workflow or tools to have small container images. Slim interacts with your application for you when HTTP probing is enabled, and you can also interact with the temporary container via a shell script or snippet using --exec-file or --exec.

Slim has been used with various application types and operating systems, including Node.js, Python, Ruby, Java, Go, Rust, Elixir, and PHP, running on Ubuntu, Debian, CentOS, Alpine, and even Distroless. Some application stacks may require advanced container probing to make sure that all dynamically loaded components are detected. In such cases, you might need to use the --http-probe* flags or the --include-path flag to make sure everything your application needs is included.

Slim is easy to install on various platforms, including Linux, macOS, and through Homebrew, Docker, or Slim.AI SaaS. It provides an interactive CLI prompt for easy usage and supports various global and command-specific flags for customization.

Slim’s commands include xray for static analysis, lint for analyzing container instructions in Dockerfiles, build for analyzing, profiling, and optimizing container images, debug for debugging running containers, registry for executing registry operations, profile for collecting fat image information, merge for merging container images, images for getting information about container images, vulnerability for executing vulnerability related tools, version for showing version information, appbom for showing application BOM, update for updating the app, and help for showing help info.

Slim’s global options include --report, --check-version, --version, --debug, --verbose, --log-level, --log-format, --crt-api-version, --quiet, --output-format, --log, --host, --tls, --tls-verify, --tls-cert-path, --state-path, --archive-state, --in-container, and various other flags for customizing the Slim experience.

Slim’s lint command options include --target, --target-type, --skip-build-context, --build-context-dir, --skip-dockerignore, --include-check-label, --exclude-check-label, --include-check-id, --include-check-id-file, --exclude-check-id, --exclude-check-id-file, --show-nohits, --show-snippet, and --list-checks.

Slim’s xray command options include --target, --pull, --docker-config-path, --registry-account, --registry-secret, --show-plogs, --changes, --changes-output, --layer, --add-image-manifest, --add-image-config, --layer-changes-max, --all-changes-max, --add-changes-max, --modify-changes-max, --delete-changes-max, --change-path, --change-data, --change-data-hash, --reuse-saved-image, --top-changes-max, --hash-data, --detect-duplicates, --show-duplicates, --show-special-perms, --detect-utf8, --detect-all-certs, --detect-all-cert-pks, --detect-identities, --change-match-layers-only, --export-all-data-artifacts, and --remove-file-artifacts.

Slim’s build command options include --target, --pull, --docker-config-path, --registry-account, --registry-secret, --show-plogs, --compose-file, --target-compose-svc, --target-compose-svc-image, --target-compose-svc-no-ports, --dep-exclude-compose-svc-all, --dep-include-compose-svc, --dep-exclude-compose-svc, --dep-include-compose-svc-deps, --dep-include-target-compose-svc-deps, --compose-svc-start-wait, --compose-net, --compose-env-nohost, --compose-env-file, --compose-workdir, --compose-project-name, --container-probe-compose-svc, --prestart-compose-svc, --poststart-compose-svc, --http-probe, --http-probe-off, --http-probe-cmd, --http-probe-cmd-file, --http-probe-start-wait, --http-probe-retry-count, --http-probe-retry-wait, --http-probe-ports, --http-probe-full, and --http-probe-exit-on-failure.