slimtoolkit / slimtoolkit/slim
Unable to scan a slimmed image for bom and security issues
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 23.4k
- Forks
- 840
- PR merge metrics
- No merged PRs in 30d
Description
I'm building a minified ubuntu:20.04 based image with a few applications. I have to specify the applications to keep manually using several include statements as shown below.
docker run -it --rm
-v /var/run/docker.sock:/var/run/docker.sock
-v ${DOC_BUILD_ROOT}/docker-slim-state:/bin/.docker-slim-state
dslim/docker-slim build
--http-probe=false
--continue-after 1
--tag=${IMAGE}.slim:${VERSION}
\ # Restore dependencies listed below
--include-shell \
--include-path=/etc \
--include-bin=/bin/sh \
--include-bin=/bin/sleep \
--include-bin=/sbin/ip \
--include-bin=/usr/bin/python3 \
--include-path=/usr/bin/supervisorctl \
--include-bin=/usr/sbin/tcpdump \
--include-path=/lib/libgcc_s.so.1 \
--include-path=/lib/x86_64-linux-gnu/libgcc_s.so.1
--include-path=/usr/lib/python3 \
--include-path=/usr/lib/python3.8
--include-path=/usr/local/lib/python3.8 \
--include-path=/opt/ \
--include-path=/var/log
${IMAGE}:${VERSION}
Minifying an image appears to break scanning tools such as 'docker scan' and 'docker sbom'. These scanning tools are unable to properly scan/inventory my 'slim' image. Is there a way to specify a list of dpkg (dpkgdb) packages to keep, or some other way of preserving dpkgdb for the packages I want to keep?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no source files, tests, or entry points. Reproduce the slim-image workflow with the listed dpkg-based Ubuntu image, then compare docker scan and docker sbom results before and after minification; done means retained package metadata allows both tools to inventory the image correctly.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, ubuntu
- Domain
- devops, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100