DOCSEARCHbyAlgolia
Submit Docs

Mint Toolkit

repository·master·Indexed 43 days ago

https://github.com/mintoolkit/mint

A toolkit for inspecting, minifying, customizing, securing, and debugging containers. It includes the `mint` CLI for container lifecycle management, security scanning (xray), and image manipulation, as well as the `mint-sensor` binary. The toolkit provides capabilities for building, linting, profiling, and vulnerability scanning of container images, and includes a Docker CLI plugin integration.

Tokens
48.1K
Snippets
119
Records
218
Agent score
55%

What's inside Mint

  2. Translate OCI/Docker runtime strings to CRO requests

    master

    The nvidia_runtime example demonstrates how to translate standard OCI/Docker runtime and capability strings into the format required by the CRO (Container Runtime Orchestrator).

    For example, the Docker flag --runtime=nvidia --gpus all can be translated to the following CRO configuration:

    • --cro-device-request '{"Count":-1, "Capabilities":[["gpu"]]}'
    • --cro-runtime nvidia
    # Example translation mapping
# FROM: --runtime=nvidia --gpus all
# TO:
--cro-device-request '{"Count":-1, "Capabilities":[["gpu"]]}' --cro-runtime nvidia

  3. Access containerized application examples

    master

    Containerized application examples for minifying application container images have been moved to a dedicated repository. These examples cover various base images, programming languages, and language frameworks. You can use these as a starting point to learn how to minify your specific application container image by selecting an example that closely matches your application's stack.

    https://github.com/slimtoolkit/examples

  5. Run the Fedora 39 and Docker CE 26.1.1 example environment

    master

    This example provides a Vagrant-based environment running Fedora 39, Docker CE 26.1.1, and Mint 1.41.1.

    To spin up the virtual machine, use vagrant up. Once the VM is running, access it via vagrant ssh.

    After accessing the VM, you can execute the following test scripts to verify the environment:

    • ./slim.sh: Runs slim-related tests.
    • ./run.sh: Runs the standard execution scripts.
    • ./test.sh: Runs the full test suite.
    # Spin up the VM
vagrant up

# Access the VM
vagrant ssh

# Run tests inside the VM
./slim.sh
./run.sh
./test.sh

  6. Use the mint CLI

    master

    The mint CLI is used to inspect, minify, customize, secure, and debug containers. It supports a wide range of commands for container lifecycle management, security scanning, and image manipulation.

    If you provide an unknown command, the CLI will display an error message and show the application help text.

    mint <command> [arguments] [flags]

  7. Configure xray detection operations

    master

    The xray command supports several detection operations that can be enabled and configured via specific flags. Each operation follows a similar pattern for enabling, passing parameters, and dumping raw data.

    Supported Operations:

    • detect-identities
    • detect-scheduled-tasks
    • detect-services
    • detect-system-hooks

    Operation Configuration Pattern: For each operation, you can use:

    1. Enable: Use the --detect-<operation> flag.
    2. Parameters: Use --detect-<operation>-param with key=value pairs to pass specific input parameters.
    3. Raw Data Dump: Use --detect-<operation>-dump-raw to save the raw data found during detection.

    Dumping Raw Data Formats:

    • console: Output raw data to the console.
    • dir:<path>: Save raw data to a directory.
    • <path>: Save raw data to a specific file.
    • .: Use the default archive path (e.g., ./raw-identities.tar).
    • no: Disable raw data dumping.

    Example:

    mint xray <image> --detect-services --detect-services-param key1=val1 --detect-services-dump-raw dir:/tmp/services_raw

  8. Configure change path and data matchers

    master

    The xray command allows you to filter or extract specific information using path and data matchers via --change-path and --change-data flags.

    Path Matchers (--change-path): Supports patterns to match file paths. You can also dump the matched files.

    • path_pattern: Match files by pattern.
    • ::path_pattern: Match files by pattern (shorthand).
    • dump:output:path_pattern: Match files by pattern and dump them to output.

    Data Matchers (--change-data): Supports patterns to match file content. You can also dump the matched data.

    • data_pattern: Match data by regex.
    • :path_pattern:data_pattern: Match data using a path pattern and a data regex.
    • dump:output:path_pattern:data_pattern: Match data and dump it to output.

    Data Hash Matchers (--change-data-hash): Matches data based on its hash.

    • hash_value: Match data with a specific hash.
    • ::hash_value: Shorthand for matching hash.
    • dump:output:hash_value: Match data and dump it to output.

  9. Start a new Podman debug session

    master

    Spawns a new debug sidecar container attached to a target container. The sidecar is configured to share the target's Network, IPC, and PID namespaces, allowing it to inspect the target's internal state.

    Key Features:

    • Namespace Sharing: Automatically attaches PidNS and NetNS from the target container. If the target's IPC mode is shareable, it also attaches IpcNS.
    • Terminal Support: If DoTerminal is enabled, the tool sets up a raw terminal interface with window resize support (SIGWINCH) to allow interactive debugging.
    • Automatic Cleanup: The debug container is stopped and removed automatically when the session ends or the command is interrupted.

    Configuration Options:

    • DebugContainerImage: The image to use for the debugger sidecar (will be pulled if not present).
    • DoRunAsTargetShell: If true, configures the entrypoint to run a shell command prefix.
    • DoTerminal: Enables interactive terminal mode.

  10. Identify duplicate files and wasted space in xray

    master

    The xray command can detect duplicate files within an image using hash references. This is useful for identifying bloat and optimizing image size.

    Duplicate Report Details

    When duplicates are detected, the following information is provided:

    • hash: The content hash of the duplicate files.
    • count: Number of files sharing this hash.
    • size.bytes / size.human: The size of a single instance of the file.
    • all_size.bytes / all_size.human: The total size occupied by all instances.
    • wasted.bytes / wasted.human: The total wasted space (calculated as all_size - size_of_one_instance).
    • name: The file path of the specific instance.
    • layer: The layer index where the instance resides.

  11. Configure xray image inspection via target-image-archive

    master

    When using the --target-image-archive flag, xray performs analysis on the provided file.

    Key behaviors:

    • The archive must be a regular file.
    • xray extracts image metadata (ID, tags) from the archive to identify the target.
    • It performs 'data inspection' by loading the package from the archive path.
    • If --rm-file-artifacts is not set, the extracted image archive is preserved in the artifact location.
    • If --do-add-image-manifest or --do-add-image-config are enabled, the raw manifest and config are included in the final report.
    mint xray --target-image-archive /path/to/image.tar

  12. Configure 'continue-after' modes for the profile command

    master

    The profile command supports several modes to control when the instrumentation continues or finishes, controlled via the continue-after mechanism. This is useful for allowing a container to reach a specific state before data collection is finalized.

    Supported modes include:

    • CAMEnter: The command pauses and waits for the user to press <ENTER> in the terminal. Use this when you want to manually interact with the container (e.g., via exec) before finishing the profile.
    • CAMSignal: The command waits for the user to send a SIGUSR1 signal to the process.
    • CAMTimeout: The command waits for a specified number of seconds.
    • CAMProbe: The command waits for an HTTP probe to complete successfully. This is often used with --http-probe=true to ensure the application service is up and running.
    • CAMHostExec: Runs specific probes on the host machine.
    • CAMAppExit: Waits for the target application within the container to exit.