slim
Slim(toolkit): Don't change anything in your container image and minify it by up to 30x (and for compiled languages even more) making it secure too! (free and open source)
A tool that automatically shrinks Docker container images by up to 30x in size without changing your code, reducing storage costs and security risks by stripping unused files.
Slim (formerly DockerSlim) is a tool that automatically shrinks Docker container images — often by 30 times or more in size — without requiring any changes to your Dockerfile or application code. Containers are a way of packaging an application with everything it needs to run, but they often end up including far more files, libraries, and tools than the app actually uses. Slim analyzes what your app truly needs at runtime and strips everything else away.
The way it works: Slim temporarily runs your container, observes what files, system calls, and resources the application actually touches during operation, and then builds a new minimal image containing only those essential components. The result is a much smaller image that also has a reduced security attack surface — fewer files means fewer potential vulnerabilities.
It works across many application types including Node.js, Python, Ruby, Java, Go, and Rust, and with various base images like Ubuntu, Debian, Alpine, and Distroless. Beyond size reduction, it also provides commands to inspect images, lint Dockerfiles, debug containers, and even automatically generate security profiles (AppArmor and Seccomp).
You would use Slim in a CI/CD pipeline to shrink container images before deploying to production, reducing storage costs, transfer times, and security risk. It is written in Go, free and open source, and is a CNCF Sandbox project.
Where it fits
- Shrink a Node.js or Python Docker image from hundreds of MB down to tens of MB before deploying to production.
- Add a Slim step to a CI/CD pipeline to automatically minimize container images before pushing to a registry.
- Reduce the attack surface of a containerized app by stripping all files the app does not actually use at runtime.
- Automatically generate AppArmor or Seccomp security profiles for a containerized application.