SlimImage: Slashing Container Size by Up to 95% While Hardening Production Cloud Infrastructure

说明与用途

SlimImage 将容器大小降至38 MB，消除所有漏洞，将拉取时间缩短至0.3 s，提升弹性并降低网络成本。

问题

Container images are often bloated with unnecessary tools, libraries, and binaries, causing slow pull times, high storage and egress costs, and large attack surfaces.

结果

SlimImage cuts image size by up to 96 %, removes all CVEs, and reduces cold pull time from several seconds to sub‑second, improving autoscaling latency and lowering network costs.

工作流

• Build the original image with Docker
• Run slimimage build --target <image> --tag <image>:slim --probe-http-get /healthz --probe-exec "python -c 'import app; print(\"Synthesized\")'" --preserve-ca-certs --generate-sbom
• Verify size reduction with docker images --format "table {{.Repository}} {{.Tag}} {{.Size}}"
• Scan both images with Trivy to confirm CVE count
• Integrate the command into CI/CD (e.g., GitHub Actions) to harden every build

证据

Standard Node.js Image (~1.1 GB) … SlimImage Optimized Artifact (~38 MB)

来源

Node.js (v20 Bullseye) 1,080 MB → 42 MB, 96.1% reduction, 0 CVEs, ~0.35s pull vs 8.9s

来源

trivy image my-service:latest | grep -E "Total: [0-9]+" # Total: 78 ... trivy image my-service:slim | grep -E "Total: [0-9]+" # Total: 0

来源