This GitHub Action helps you to minify your container image, making it smaller and more secure. With this Action, you can reduce the size of your container image by up to 30x (and even more for compiled languages) without compromising its functionality.
This GitHub Action uses slimtoolkit/slim to minimize your container image. slim is an open-source tool that removes unnecessary files and libraries from your image, resulting in a smaller and more secure container.
Slim uses static and dynamic analysis techniques to identify the components of your image that are not needed at runtime. It also removes debug symbols, unused files, and libraries that are not required by your application, reducing the size of your image.
See their README for more information about how Slim works.
To use this GitHub Action, you will need to have the docker/login-action or docker/build-push-action set up in your workflow as well. These actions will allow you to execute Docker commands needed for this action to run successfully.
Create a workflow file in your repository and add these steps to your job:
# Build the Docker image first
- uses: docker/build-push-action@v4
with:
push: false
tags: ${{ github.repository }}:latest
# Slim it!
- uses: kitabisa/docker-slim-action@v1
env:
DSLIM_HTTP_PROBE: false
with:
target: ${{ github.repository }}:latest
tag: "slim"
# Push to the registry
- run: docker image push "${{ github.repository }}" --all-tagsIn this example, it will minify ${{ github.repository }}:latest as target and will create a slimmed version of the target image with the slim tag from the input (${{ github.repository }}:slim) then push the images to the registry.
The following input actions are supported:
| Name | Description | Required? | Type | Default |
|---|---|---|---|---|
overwrite |
Overwrite target container image with slimmed version (only if target is not ID) | 🔴 | boolean | false |
tag |
Specify a tag for slimmed target container image | 🟢 | string | slim |
target |
Target container image (name or ID) | 🟢 | string | |
version |
Define Slim version | 🔴 | string |
Caution
Enabling the overwrite option will result in the replacement of the target image (original) with its slimmed version, regardless of the tag input.
You can also control the behavior of the Slim build command by setting the following environment variables:
| Environment | Description |
|---|---|
DSLIM_PULL |
Try pulling target if it's not available locally (default: false) |
DSLIM_DOCKER_CONFIG_PATH |
Docker config path (used to fetch registry credentials) |
DSLIM_REGISTRY_ACCOUNT |
Target registry account used when pulling images from private registries |
DSLIM_REGISTRY_SECRET |
Target registry secret used when pulling images from private registries |
DSLIM_PLOG |
Show image pull logs (default: false) |
DSLIM_COMPOSE_FILE |
Load container info from selected compose file(s) |
DSLIM_TARGET_COMPOSE_SVC |
Target service from compose file |
DSLIM_TARGET_COMPOSE_SVC_IMAGE |
Override the container image name and/or tag when targetting a compose service using the target-compose-svc parameter (format: tag_name or image_name:tag_name) |
DSLIM_COMPOSE_SVC_START_WAIT |
Number of seconds to wait before starting each compose service (default: 0) |
DSLIM_COMPOSE_SVC_NO_PORTS |
Do not publish ports for target service from compose file (default: false) |
DSLIM_DEP_INCLUDE_COMPOSE_SVC_ALL |
Do not start any compose services as target dependencies (default: false) |
DSLIM_DEP_INCLUDE_COMPOSE_SVC |
Include specific compose service as a target dependency (only selected services will be started) |
DSLIM_DEP_EXCLUDE_COMPOSE_SVC |
Exclude specific service from the compose services that will be started as target dependencies |
DSLIM_DEP_INCLUDE_COMPOSE_SVC_DEPS |
Include all dependencies for the selected compose service (excluding the service itself) as target dependencies |
DSLIM_DEP_INCLUDE_TARGET_COMPOSE_SVC_DEPS |
Include all dependencies for the target compose service (excluding the service itself) as target dependencies (default: false) |
DSLIM_COMPOSE_NET |
Attach target to the selected compose network(s) otherwise all networks will be attached |
DSLIM_COMPOSE_ENV_NOHOST |
Don't include the env vars from the host to compose (default: false) |
DSLIM_COMPOSE_ENV_FILE |
Load compose env vars from file (host env vars override the values loaded from this file) |
DSLIM_COMPOSE_PROJECT_NAME |
Use custom project name for compose |
DSLIM_COMPOSE_WORKDIR |
Set custom work directory for compose |
DSLIM_CONTAINER_PROBE_COMPOSE_SVC |
Container test/probe service from compose file |
DSLIM_HOST_EXEC |
Host commands to execute (aka host commands probes) |
DSLIM_HOST_EXEC_FILE |
Host commands to execute loaded from file (aka host commands probes) |
DSLIM_TARGET_KUBE_WORKLOAD |
[Experimental] Target Kubernetes workload from the manifests (if is provided) or in the default kubeconfig cluster (format: /, e.g., deployments/foobar) |
DSLIM_TARGET_KUBE_WORKLOAD_NAMESPACE |
[Experimental] Target Kubernetes workload namespace (if not set, the value from the manifest is used if provided, otherwise - "default") |
DSLIM_TARGET_KUBE_WORKLOAD_CONTAINER |
[Experimental] Target container in the Kubernetes workload's pod template spec |
DSLIM_TARGET_KUBE_WORKLOAD_IMAGE |
[Experimental] Override the container image name and/or tag when targetting a Kubernetes workload (format: tag_name or image_name:tag_name) |
DSLIM_KUBE_MANIFEST_FILE |
[Experimental] Kubernetes manifest(s) to apply before run |
DSLIM_KUBE_KUBECONFIG_FILE, $KUBECONFIG |
[Experimental] Path to the kubeconfig file (default: "/home/dw1/.kube/config") |
DSLIM_PUBLISH_PORT |
Map container port to host port (format => port |
DSLIM_PUBLISH_EXPOSED |
Map all exposed ports to the same host ports (default: false) |
DSLIM_RUN_TAS_USER |
Run target app as USER (default: true) |
DSLIM_SHOW_CLOGS |
Show container logs (default: false) |
DSLIM_SHOW_BLOGS |
Show image build logs (default: false) |
DSLIM_CP_META_ARTIFACTS |
copy metadata artifacts to the selected location when command is done |
DSLIM_RM_FILE_ARTIFACTS |
remove file artifacts when command is done (default: false) |
DSLIM_RC_EXE |
A shell script snippet to run via Docker exec |
DSLIM_RC_EXE_FILE |
A shell script file to run via Docker exec |
DSLIM_TARGET_TAG |
Custom tags for the generated image |
DSLIM_TARGET_OVERRIDES |
Save runtime overrides in generated image (values is 'all' or a comma delimited list of override types: 'entrypoint', 'cmd', 'workdir', 'env', 'expose', 'volume', 'label') |
DSLIM_CRO_RUNTIME |
Runtime to use with the created containers |
DSLIM_CRO_HOST_CONFIG_FILE |
Base Docker host configuration file (JSON format) to use when running the container |
DSLIM_CRO_SYSCTL |
Set namespaced kernel parameters in the created container |
DSLIM_CRO_SHM_SIZE |
Shared memory size for /dev/shm in the created container (default: -1) |
DSLIM_RC_USER |
Override USER analyzing image at runtime |
DSLIM_RC_ENTRYPOINT |
Override ENTRYPOINT analyzing image at runtime. To persist ENTRYPOINT changes in the output image, pass the --image-overrides=entrypoint or --image-overrides=all flag as well. |
DSLIM_RC_CMD |
Override CMD analyzing image at runtime. To persist CMD changes in the output image, pass the --image-overrides=cmd or --image-overrides=all flag as well. |
DSLIM_RC_WORKDIR |
Override WORKDIR analyzing image at runtime. To persist WORKDIR changes in the output image, pass the --image-overrides=workdir or --image-overrides=all flag as well. |
DSLIM_RC_ENV |
Override or add ENV only during runtime. To persist ENV additions or changes in the output image, pass the --image-overrides=env or --image-overrides=all flag as well. |
DSLIM_RC_LABEL |
Override or add LABEL analyzing image at runtime. To persist LABEL additions or changes in the output image, pass the --image-overrides=label or --image-overrides=all flag as well. |
DSLIM_RC_VOLUME |
Add VOLUME analyzing image at runtime. To persist VOLUME additions in the output image, pass the --image-overrides=volume or --image-overrides=all flag as well. |
DSLIM_RC_LINK |
Add link to another container analyzing image at runtime |
DSLIM_RC_ETC_HOSTS_MAP |
Add a host to IP mapping to /etc/hosts analyzing image at runtime |
DSLIM_RC_DNS |
Add a dns server analyzing image at runtime |
DSLIM_RC_DNS_SEARCH |
Add a dns search domain for unqualified hostnames analyzing image at runtime |
DSLIM_RC_NET |
Override default container network settings analyzing image at runtime |
DSLIM_RC_HOSTNAME |
Override default container hostname analyzing image at runtime |
DSLIM_RC_EXPOSE |
Use additional EXPOSE instructions analyzing image at runtime. To persist EXPOSE additions in the output image, pass the --image-overrides=expose or --image-overrides=all flag as well. |
DSLIM_MOUNT |
Mount volume analyzing image |
DSLIM_IMAGE_BUILD_ENG |
Select image build engine: internal |
DSLIM_IMAGE_BUILD_ARCH |
Select output image build architecture |
DSLIM_BUILD_DOCKERFILE |
The source Dockerfile name to build the fat image before it's optimized |
DSLIM_BUILD_DOCKERFILE_CTX |
The build context directory when building source Dockerfile |
DSLIM_TARGET_TAG_FAT |
Custom tag for the fat image built from Dockerfile |
DSLIM_CBO_ADD_HOST |
Add an extra host-to-IP mapping in /etc/hosts to use when building an image |
DSLIM_CBO_BUILD_ARG |
Add a build-time variable |
DSLIM_CBO_CACHE_FROM |
Add an image to the build cache |
DSLIM_CBO_LABEL |
Add a label when building from Dockerfiles |
DSLIM_CBO_TARGET |
Target stage to build for multi-stage Dockerfiles |
DSLIM_CBO_NETWORK |
Networking mode to use for the RUN instructions at build-time |
DSLIM_DELETE_FAT |
Delete generated fat image requires flag (default: false) |
DSLIM_NEW_ENTRYPOINT |
New ENTRYPOINT instruction for the optimized image |
DSLIM_NEW_CMD |
New CMD instruction for the optimized image |
DSLIM_NEW_EXPOSE |
New EXPOSE instructions for the optimized image |
DSLIM_NEW_WORKDIR |
New WORKDIR instruction for the optimized image |
DSLIM_NEW_ENV |
New ENV instructions for the optimized image |
DSLIM_NEW_VOLUME |
New VOLUME instructions for the optimized image |
DSLIM_NEW_LABEL |
New LABEL instructions for the optimized image |
DSLIM_RM_EXPOSE |
Remove EXPOSE instructions for the optimized image |
DSLIM_RM_ENV |
Remove ENV instructions for the optimized image |
DSLIM_RM_LABEL |
Remove LABEL instructions for the optimized image |
DSLIM_RM_VOLUME |
Remove VOLUME instructions for the optimized image |
DSLIM_EXCLUDE_MOUNTS |
Exclude mounted volumes from image (default: true) |
DSLIM_EXCLUDE_PATTERN |
Exclude path pattern (Glob/Match in Go and **) from image |
DSLIM_PRESERVE_PATH |
Keep path from orignal image in its initial state (changes to the selected container image files when it runs will be discarded) |
DSLIM_PRESERVE_PATH_FILE |
File with paths to keep from original image in their original state (changes to the selected container image files when it runs will be discarded) |
DSLIM_INCLUDE_PATH |
Keep path from original image |
DSLIM_INCLUDE_PATH_FILE |
File with paths to keep from original image |
DSLIM_INCLUDE_BIN |
Keep binary from original image (executable or shared object using its absolute path) |
DSLIM_INCLUDE_BIN_FILE |
File with shared binary file names to include from image |
DSLIM_INCLUDE_EXE_FILE |
File with executable file names to include from image |
DSLIM_INCLUDE_EXE |
Keep executable from original image (by executable name) |
DSLIM_INCLUDE_SHELL |
Keep basic shell functionality (default: false) |
DSLIM_INCLUDE_PATHS_CREPORT_FILE |
Keep files from the referenced creport |
DSLIM_INCLUDE_OSLIBS_NET |
Keep the common networking OS libraries (default: true) |
DSLIM_INCLUDE_CERT_ALL |
Keep all discovered cert files (default: true) |
DSLIM_INCLUDE_CERT_BUNDLES |
Keep only cert bundles (default: false) |
DSLIM_INCLUDE_CERT_DIRS |
Keep known cert directories and all files in them (default: false) |
DSLIM_INCLUDE_CERT_PK_ALL |
Keep all discovered cert private keys (default: false) |
DSLIM_INCLUDE_CERT_PK_DIRS |
Keep known cert private key directories and all files in them (default: false) |
DSLIM_INCLUDE_NEW |
Keep new files created by target during dynamic analysis (default: true) |
DSLIM_KEEP_TMP_ARTIFACTS |
Keep temporary artifacts when command is done (default: false) |
DSLIM_INCLUDE_APP_NUXT_DIR |
Keep the root Nuxt.js app directory (default: false) |
DSLIM_INCLUDE_APP_NUXT_BUILD_DIR |
Keep the build Nuxt.js app directory (default: false) |
DSLIM_INCLUDE_APP_NUXT_DIST_DIR |
Keep the dist Nuxt.js app directory (default: false) |
DSLIM_INCLUDE_APP_NUXT_STATIC_DIR |
Keep the static asset directory for Nuxt.js apps (default: false) |
DSLIM_INCLUDE_APP_NUXT_NM_DIR |
Keep the node modules directory for Nuxt.js apps (default: false) |
DSLIM_INCLUDE_APP_NEXT_DIR |
Keep the root Next.js app directory (default: false) |
DSLIM_INCLUDE_APP_NEXT_BUILD_DIR |
Keep the build directory for Next.js app (default: false) |
DSLIM_INCLUDE_APP_NEXT_DIST_DIR |
Keep the static SPA directory for Next.js apps (default: false) |
DSLIM_INCLUDE_APP_NEXT_STATIC_DIR |
Keep the static public asset directory for Next.js apps (default: false) |
DSLIM_INCLUDE_APP_NEXT_NM_DIR |
Keep the node modules directory for Next.js apps (default: false) |
DSLIM_INCLUDE_NODE_PKG |
Keep node.js package by name |
DSLIM_KEEP_PERMS |
Keep artifact permissions as-is (default: true) |
DSLIM_PATH_PERMS |
Set path permissions in optimized image |
DSLIM_PATH_PERMS_FILE |
File with path permissions to set |
DSLIM_CONTINUE_AFTER |
Select continue mode: enter |
DSLIM_USE_LOCAL_MOUNTS |
Mount local paths for target container artifact input and output (default: false) |
DSLIM_USE_SENSOR_VOLUME |
Sensor volume name to use |
DSLIM_RTA_ONBUILD_BI |
Enable runtime analysis for onbuild base images (default: false) |
DSLIM_RTA_SRC_PT |
Enable PTRACE runtime analysis source (default: true) |
DSLIM_SENSOR_IPC_ENDPOINT |
Override sensor IPC endpoint |
DSLIM_SENSOR_IPC_MODE |
Select sensor IPC mode: proxy |
DSLIM_HTTP_PROBE_OFF |
Alternative way to disable HTTP probing (default: false) |
DSLIM_HTTP_PROBE |
Enable or disable HTTP probing (default: true) |
DSLIM_HTTP_PROBE_CMD |
User defined HTTP probes |
DSLIM_HTTP_PROBE_CMD_FILE |
File with user defined HTTP probes |
DSLIM_HTTP_PROBE_START_WAIT |
Number of seconds to wait before starting HTTP probing (default: 0) |
DSLIM_HTTP_PROBE_RETRY_COUNT |
Number of retries for each HTTP probe (default: 5) |
DSLIM_HTTP_PROBE_RETRY_WAIT |
Number of seconds to wait before retrying HTTP probe (doubles when target is not ready) (default: 8) |
DSLIM_HTTP_PROBE_PORTS |
Explicit list of ports to probe (in the order you want them to be probed) |
DSLIM_HTTP_PROBE_FULL |
Do full HTTP probe for all selected ports (if false, finish after first successful scan) (default: false) |
DSLIM_HTTP_PROBE_EXIT_ON_FAILURE |
Exit when all HTTP probe commands fail (default: true) |
DSLIM_HTTP_PROBE_CRAWL |
http-probe-crawl (default: true) |
DSLIM_HTTP_CRAWL_MAX_DEPTH |
Max depth to use for the HTTP probe crawler (default: 3) |
DSLIM_HTTP_CRAWL_MAX_PAGE_COUNT |
Max number of pages to visit for the HTTP probe crawler (default: 1000) |
DSLIM_HTTP_CRAWL_CONCURRENCY |
Number of concurrent workers when crawling an HTTP target (default: 10) |
DSLIM_HTTP_MAX_CONCURRENT_CRAWLERS |
Number of concurrent crawlers in the HTTP probe (default: 1) |
DSLIM_HTTP_PROBE_API_SPEC |
Run HTTP probes for API spec |
DSLIM_HTTP_PROBE_API_SPEC_FILE |
Run HTTP probes for API spec from file |
Important
Please note that when you disable HTTP probing (either by setting DSLIM_HTTP_PROBE_OFF to true or DSLIM_HTTP_PROBE to false), it will effectively modify the behavior of the continue mode (if the DSLIM_CONTINUE_AFTER value is undefined) by imposing a timeout of 1 second. This adjustment occurs because, by default, when HTTP probes are disabled, the Slim's behavior will switch to 'enter' mode — and there is no way to interact with the temporary container created by Slim within the GitHub Action runner.
To view the report results generated by the Slim build command, you can access the report property (Object) of the steps outputs context. Here's an example of how to access it: ${{ steps.<id>.outputs.report }}.
# Slim it!
- uses: kitabisa/docker-slim-action@v1
id: slim
env:
DSLIM_HTTP_PROBE: false
with:
target: ${{ github.repository }}:latest
# Dump the report
- run: echo "${REPORT}"
env:
REPORT: ${{ steps.slim.outputs.report }}The associated scripts and documentation in this project are released under the MIT License.
Binary used in this project include third party materials.
