Slim Toolkit

If you are looking for examples of containerized applications to use as a starting point for minifying your own application container images, these have been moved to a dedicated repository. The examples cover various base images, programming languages, and language frameworks. You should select an example that closely matches your application's stack to serve as a template for your minification process.

https://github.com/slimtoolkit/examples

The slim CLI is a tool designed to inspect, optimize, and debug containers. It provides a wide range of commands for container lifecycle management, security analysis, and optimization.

Core capabilities include:

• Optimization: build for creating slim images, merge for combining layers.
• Security & Inspection: xray for deep inspection, vulnerability for scanning, lint for checking container configurations, and appbom for generating Application Bill of Materials.
• Analysis: profile for performance profiling, debug for troubleshooting, and probe for inspecting container state.
• Management: images for managing images, registry for interacting with registries, and run for executing containers.
• System: version for checking the current version, update for updating the tool, and install for installation tasks.

The registry command (alias reg) is used to perform various container registry operations, including pulling, pushing, copying images, creating image indexes, and running a local registry server. Most registry commands support authentication via Docker credentials or explicit account/secret flags.

slim registry [subcommand] [flags]

The continue-after mode determines when the profile command stops waiting for the container and proceeds to data collection and shutdown. This is crucial for ensuring the application has actually performed the actions you want to profile.

Available modes include:

• CAMEnter: The command waits for manual user input. It will prompt: USER INPUT REQUIRED, PRESS <ENTER> WHEN YOU ARE DONE USING THE CONTAINER.
• CAMSignal: The command waits for a SIGUSR1 signal to be sent to the process.
• CAMTimeout: The command waits for a specified number of seconds.
• CAMProbe: The command waits for an HTTP probe to successfully complete (requires --http-probe=true).
• CAMHostExec: The command runs specific probes on the host machine.
• CAMAppExit: The command waits for the target application to exit.

The vulnerability command supports two primary EPSS operations via the --op flag:

1. lookup: Used to retrieve specific EPSS information for a given CVE. This is the default operation.
2. list: Used to retrieve a list of EPSS records. This operation supports advanced filtering and ordering via flags like --filter-score-gt, --filter-percentile-lt, and --filter-order-records.

If you do not provide explicit configuration paths, you can use WithDefaultConfigPath to search for standard Compose files in the working directory or its parent directories.

Supported Config Files (in order of preference):

• compose.yaml
• compose.yml
• docker-compose.yml
• docker-compose.yaml

Supported Override Files (in order of preference):

• compose.override.yml
• compose.override.yaml
• docker-compose.override.yml
• docker-compose.override.yaml

If multiple files are found, the first one in the preference list is used, and a warning is logged.

When a command is processed, the toolkit returns a Response object. This object indicates whether the operation was successful or encountered an error.

Status Values:

• ok: The command was executed successfully.
• error: The command failed.

Response Structure:

{
  "status": "ok"
}

type Response struct {
	Status string `json:"status"`
}

const (
	ResponseStatusOk    = "ok"
	ResponseStatusError = "error"
)

The sensor operates in one of two modes, configured via the -m or --mode flag:

• controlled: The sensor expects the driver (e.g., slim) to manipulate its lifecycle. This is the default mode.
• standalone: The sensor depends on nothing but the target application. It uses a command file to determine actions.

Use the -m flag to switch between them.

# Example: Run in standalone mode
./sensor --mode standalone --command-file /path/to/commands.json

You can fine-tune the linting process by selecting specific checks. This is useful for focusing on specific security categories or ignoring known issues.

• Use inclusion/exclusion flags for IDs to target specific rules.
• Use inclusion/exclusion flags for Labels to target groups of rules (e.g., all security-related checks).

To see how EPSS scores and percentiles have changed over time for specific CVEs or lists, use the history flag (implied by the WithHistory parameter in the command implementation).

When history is enabled, the output includes a history component for each score, showing the progression of the Value (EPSS score), Percentile, and Date.

In the xray output, the H field represents the lifecycle history of an object within the image layers. It uses a compact string format:

H=[A:<layer>/M:<layer1>,<layer2>/D:<layer>]

• A:<layer>: Indicates the layer where the object was Added.
• /M:<layer1>,<layer2>: Indicates the layers where the object was Modified.
• /D:<layer>: Indicates the layer where the object was Deleted.

Example: H=[A:5/M:7,8] means the object was added in layer 5 and modified in layers 7 and 8.