PAGES
← all tools
◆ Container & Image Security

slimtoolkit

1.40.11 open-source

Inspects, optimizes, and minifies container images by analyzing application behavior to remove unnecessary components and generate security profiles.

Summary

slimtoolkit is an open-source, free command-line tool that inspects and shrinks container images by analyzing what an application actually uses at runtime, then stripping out the rest and auto-generating security profiles. You run it as a CLI against a Docker (or other container-runtime) build to produce a minified image, so it fits into a build pipeline rather than running as a service. It's aimed at developers and platform engineers who own container builds and want smaller, less exposed images without hand-editing Dockerfiles. Its own documentation frames it as the optimization half of a workflow that pairs with Root.io's vulnerability remediation for ongoing security. First committed in 2014 and now a CNCF Sandbox project with 78 contributors, it still saw 34 commits in the past year, though its last tagged release was over two and a half years ago.

Inspects, optimizes, and minifies container images by analyzing application behavior to remove unnecessary components and generate security profiles.

How slimtoolkit helps

How much smaller could this image be without changing what it does?

runs the application through its normal behavior while watching every file, package, and dependency actually touched, then builds a minified image containing only that set, so the reduction reflects real usage rather than a guess

Which files and packages in this image does the application never actually touch?

traces runtime behavior during a probed run and reports the full inventory of unused files and dependencies before anything is stripped, so the list can be reviewed before it is acted on

What would a compromised process inside this container be able to reach?

auto-generates a security profile from the same runtime trace, constraining the container to the calls and paths it was observed using

Is this build still working the same way after minification?

supports running the target application's own commands or an exec probe against the slimmed image so behavior can be checked before the smaller image replaces the original

What's actually different between two versions of the same image?

compares images and reports the object-level differences between them, including OCI-format images

Which known vulnerabilities in my dependencies are worth prioritizing right now?

looks up EPSS scores for identified vulnerabilities so exposure can be weighed by likelihood of exploitation rather than severity rating alone

all 14 features, with the evidence for each →

Languages

Not documented

Features

14 capabilities · 1 backed by code, an API document or a real run

Built from slimtoolkit's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

What slimtoolkit offers you

  • Command-line interface8
  • JSON data export1
  • Self-hosted deployment1
All capabilities 14 capabilities
Container image slimming verified Selectively include or exclude files, binaries, SSH client components, and dependency paths to produce a minimal container image. 46 releases · 19 other sources · first seen Aug 2018

Also counts toward: Command-line interface

release 46 total

  • Introduces the images command to list container images 1.40.11 · Feb 2024 · source · release history
  • Adds the vulnerability command for vulnerability analysis 1.40.8 · Jan 2024 · source · release history
  • Adds the images command to list container images 1.40.8 · Jan 2024 · source · release history
  • Adds the registry server command to host a local OCI registry 1.40.8 · Jan 2024 · source · release history
  • Adds the registry push command to push local images to a registry 1.40.8 · Jan 2024 · source · release history
  • Adds the epss subcommand to lookup EPSS scores for vulnerabilities 1.40.8 · Jan 2024 · source · release history

docs

  • Inspects, optimizes, and minifies container images by analyzing application behavior to remove unnecessary components and generate security profiles.

command line

  • --include-paths-creport-file — - Keep files from the referenced creport 1.40.11 · Feb 2024 · command-line history
  • --include-ssh-client — - Keep the common SSH client components and configs 1.40.11 · Feb 2024 · command-line history
  • --include-dir-bins — - Include binaries in the target directory and include their dependencies, which could be in other locations (executables or shared objects using its absolute path) 1.40.11 · Feb 2024 · command-line history

example 15 total

  • List all available container images managed by the tool. slim images 1.40.11 · Feb 2024 · source
  • Include the application's working directory in the slimmed container during build. slim build --include-workdir myimage 1.40.1 · Apr 2023 · source
  • Specify buildkit as the engine and amd64 as the architecture when creating a slimmed Docker image. docker-slim build --image-build-engine buildkit --image-build-arch amd64 <image_name> 1.40.0 · Jan 2023 · source
  • Pull a private image and slim it using credentials directly on the CLI. docker-slim pull --target <image:tag> --registry-account <user> --registry-secret <pass> 1.37.2 · Nov 2021 · source
  • Build an image from a Dockerfile and automatically clean up the intermediate fat image. docker-slim build --target ./Dockerfile --delete-generated-fat-image 1.37.2 · Nov 2021 · source
  • Slim a compose application while explicitly setting the project name and environment file. docker-slim compose build --compose-project-name myproject --compose-env-file .env.local 1.37.2 · Nov 2021 · source
Application binary interface analysis (AppBOM) shipped Generates an Application Bill of Materials by analyzing application components and dependencies during runtime or build processes. 16 releases · 6 other sources · first seen Feb 2020

Also counts toward: Command-line interface

release 16 total

  • Adds appbom command to the main app and --appbom flag in the sensor 1.40.3 · Jul 2023 · source · release history
  • Adds Xray certificate detection to the scanning workflow. 1.36.4 · Sep 2021 · source · release history
  • Detects additional shells during the scanning process to improve coverage of non-standard environments. 1.36.1 · Jun 2021 · source · release history
  • Adds --detect-duplicates and --show-duplicates flags to slim xray for finding duplicate files. 1.36.0 · Jun 2021 · source · release history
  • Adds the ability for slim xray to detect all installed shells within a container image. 1.36.0 · Jun 2021 · source · release history
  • Includes container entry information and inherited (ONBUILD) instructions in slim xray file detection output. 1.36.0 · Jun 2021 · source · release history

example

  • Run xray to identify duplicate files and special permission entries in a target image. slim xray --detect-duplicates --show-duplicates --show-special-perms <image_name> 1.36.0 · Jun 2021 · source
  • Xray analysis matching changes by specific file hash to ignore content drift but detect replacement. slim xray --target myapp --change-data-hash abc123def456 1.35.0 · Apr 2021 · source
  • Limit the number of added, modified, and deleted file entries in the xray report to reduce output size. slim xray --target myimage --layer-changes-max 100 --add-changes-max 50 --modify-changes-max 50 1.34.0 · Jan 2021 · source
  • Execute a complex initialization script stored locally before optimization completes. slim target myimage --exec-file ./init_script.sh 1.33.0 · Dec 2020 · source
  • Run a setup script inside the temporary container before final image assembly. slim target myimage --exec /bin/setup.sh 1.33.0 · Dec 2020 · source
  • Define a rule to change ownership of /app/config.yml to root:wheel during optimization. docker-slim build --path-perms '/app/config.yml=owner:root,group:wheel' <image> 1.27.0 · Feb 2020 · source
Container debugging shipped Provides an interactive command-line interface to connect to and troubleshoot container processes in real-time, including support for Kubernetes. 15 releases · 6 other sources · first seen Aug 2018

Also counts toward: Command-line interface

release 15 total

  • Enables an interactive debug command terminal that connects directly to the target image (enabled by default) 1.40.4 · Aug 2023 · source · release history
  • Adds basic session management for the debug command, including logs viewing via existing flags 1.40.4 · Aug 2023 · source · release history
  • Adds more debug command flags 1.40.3 · Jul 2023 · source · release history
  • Adds Kubernetes runtime support for the debug command 1.40.3 · Jul 2023 · source · release history
  • debug, an experimental subcommand for interactive troubleshooting. 1.38.0 · Sep 2022 · source · release history
  • --cro-runtime flag controls the container runtime. 1.35.0 · Apr 2021 · source · release history

docs

  • 410 Closed 410 Closed Docs: Fix renaming for Homebrew in README.md #859 Aug 6, 2026 ion-rusnac Filter pull requests by the default branch with base:master seen Aug 2026 · source
  • Commits on Aug 2, 2026 Prevent panic when reconstructing Dockerfile from malformed image history (#854) Show description for 81940d1 0xVijay 81940d1 View commit details Copy full SHA for 81940d1 Browse repository at this point View commit details Browse repository at this point View commit details Browse repository at… seen Aug 2026 · source

example

  • Connect directly to a container's terminal for debugging without manual exec commands. slim debug <container_name> 1.40.4 · Aug 2023 · source
  • Generate a detailed x-ray report that includes the full image manifest and configuration for deeper analysis. slim xray <image> --add-image-manifest --add-image-config 1.29.0 · Mar 2020 · source
  • Inspect all files within a specific layer of a container image without optimizing it. slim xray --layer 5 myimage:latest 1.28.1 · Mar 2020 · source
  • Build an image that retains a shell for interactive debugging post-deployment. docker-slim build --include-shell myimage:latest 1.25.0 · Apr 2019 · source
HTTP probe customization shipped Provides extensive control over health checking probes, including default enabling, request body specification, and custom flags. 8 releases · 1 other source · first seen Mar 2019

release 8 total

  • Adds --http-probe-off flag to slim build to disable HTTP probing entirely. 1.36.0 · Jun 2021 · source · release history
  • --pull and --show-plogs flags enable pulling missing container images during probing. 1.35.0 · Apr 2021 · source · release history
  • --http-probe-exec and --http-probe-exec-file flags allow executing external commands as HTTP probes. 1.35.0 · Apr 2021 · source · release history
  • --http-probe-exit-on-failure flag added to exit when probe calls fail 1.30.0 · Jul 2020 · source · release history
  • --http-probe-crawl flag enables the HTTP probe crawler feature 1.30.0 · Jul 2020 · source · release history
  • Enables specifying request bodies in custom HTTP POST probes 1.25.3 · Aug 2019 · source · release history

example

  • Apply permission changes defined in an external YAML/JSON file for complex mapping. docker-slim build --path-perms-file /tmp/perms.yml <image> 1.27.0 · Feb 2020 · source
Container registry management shipped Enables pushing images to registries, creating multi-architecture image indexes, and hosting local OCI registries for image distribution. 6 releases · 2 other sources · first seen Aug 2020

Also counts toward: Command-line interface

release

  • Adds the registry server command to host a local OCI registry 1.40.8 · Jan 2024 · source · release history
  • Adds the registry push command to push local images to a registry 1.40.8 · Jan 2024 · source · release history
  • Adds registry image-index-create command to create multi-architecture images 1.40.7 · Dec 2023 · source · release history
  • registry command with pull subcommand for managing container images 1.37.4 · Feb 2022 · source · release history
  • Adds --publish-exposed-ports flag to control exposed port mapping behavior 1.32.0 · Aug 2020 · source · release history
  • Adds --publish-port flag to map container ports to specific host ports during image analysis 1.32.0 · Aug 2020 · source · release history

example

  • Automatically map all ports declared in the Dockerfile's EXPOSE directive. docker-slim slim --publish-exposed-ports myapp 1.32.0 · Aug 2020 · source
  • Map a container's internal port 8080 to host port 80 for local testing during slimming. docker-slim slim --publish-port 80:8080 myapp 1.32.0 · Aug 2020 · source
Image configuration override shipped Enables modifying Dockerfile instructions such as entrypoint, command, exposed ports, workdir, and environment variables for the resulting slimmed image without rebuilding. 3 releases · 1 other source · first seen Jul 2019

Also counts toward: Command-line interface

release

  • Enhances host network flag handling for improved control over network interactions during slimming 1.34.0 · Jan 2021 · source · release history
  • Adds --new-workdir, --new-expose, --new-label, --new-volume, --remove-volume, --remove-env, --remove-label, --remove-expose and --image-overrides flags for image metadata editing capabilities 1.31.0 · Aug 2020 · source · release history
  • Adds --new-cmd, --new-entrypoint, --new-expose, --new-workdir, --new-env and --image-overrides flags to the build command to update Dockerfile instructions in the resulting image 1.25.2 · Jul 2019 · source · release history

example

  • Override the entrypoint and expose new ports in a slimmed image without rebuilding from scratch. slim build --image-overrides --new-entrypoint /app/bin/start --new-expose 8080 . 1.25.2 · Jul 2019 · source
Base OS and architecture support shipped Extends compatibility to include CentOS distributions and ARM32 architectures for container image building. 3 releases · first seen Mar 2019

release

Update management shipped Allows the cyber tool to update its own binary and manage its local state or version from within the execution environment. 2 releases · 1 other source · first seen Apr 2019

Also counts toward: Command-line interface

release

  • Enables archiving docker-slim state into a separate Docker volume 1.26.0 · Nov 2019 · source · release history
  • Adds update subcommand to update docker-slim from within docker-slim 1.25.0 · Apr 2019 · source · release history

example

  • Update your local docker-slim binary to the latest version using the tool itself. docker-slim update 1.25.0 · Apr 2019 · source
Container image merging shipped Combines two separate container images into a single optimized image layer. 1 release · 1 other source · first seen Jul 2023

Also counts toward: Command-line interface

release

  • Adds merge command to merge two container images (optimized to merge two minified images) 1.40.3 · Jul 2023 · source · release history

example

  • List container images quietly slim --quiet images
Execution reporting shipped Saves detailed command execution reports, such as the slim.report.json file, by default during the building process. 2 releases · first seen Nov 2019

Also counts toward: JSON data export

release

  • Automatically saves command reports to /tmp when the current working directory is unwritable, ensuring progress is not lost. 1.36.1 · Jun 2021 · source · release history
  • Saves command execution report as slim.report.json by default 1.26.1 · Nov 2019 · source · release history
Self-hosted execution shipped Enables the cyber tool to run inside a container using a dedicated Docker Hub image, including support for volume-based state archiving. 2 releases · first seen Nov 2019

Also counts toward: Self-hosted deployment

release

  • Adds dslim/docker-slim Docker Hub image to run docker-slim inside a container 1.26.0 · Nov 2019 · source · release history
  • Supports running docker-slim directly inside a container using the new dslim/docker-slim image 1.26 · Nov 2019 · source · release history
Sensor control and monitoring shipped Allows standalone execution of the sensor with commands to manage its lifecycle and collect detailed data events. 1 release · first seen Nov 2023

Also counts toward: Command-line interface

release

  • Sensor standalone mode: Adds control commands, starting with stop-target-app, to control sensor execution 1.40.5 · Nov 2023 · source · release history
Dockerfile-driven slimming shipped Allows the cyber tool to build minified images directly from a provided Dockerfile rather than requiring an existing running container. 1 release · first seen Aug 2019

release

  • Adds --from-dockerfile flag to slim to build minified images directly from a Dockerfile 1.25.3 · Aug 2019 · source · release history
Non-root user support shipped Supports building container images that utilize non-default users rather than being restricted to root or default contexts. 1 release · first seen Mar 2019

release

  • Supports building images with non-default users instead of only root or default user contexts 1.24 · Mar 2019 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Media

Videos from the release notes, newest first. They play right here.

docs update Sep 15, 2026

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for slimtoolkit, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail slimtoolkit puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

Show

43 entries

  1. September 20262
  2. February 20241
  3. January 20242
  4. December 20231
  5. November 20232
  6. August 20231
  7. July 20231
  8. June 20231
  9. April 20231
  10. January 20231
  11. September 20221
  12. March 20221
  13. February 20221
  14. December 20211
  15. November 20212
  16. September 20212
  17. June 20212
  18. May 20211
  19. April 20211
  20. January 20211
  21. December 20201
  22. August 20202
  23. July 20201
  24. March 20203
  25. February 20201
  26. November 20193
  27. August 20191
  28. July 20191
  29. April 20191
  30. March 20192
  31. August 20181
    Show

    43 entries

    Project health

    Issue, contributor and maintainer activity in slimtoolkit/slim, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 4 ±0 vs prior 12 months
    2. Maintainers 0 +0 joined · −0 left, last 12 months
    3. Bus factor 0 committers behind half the commits
    4. Community-filed 100% of issues opened, last 12 months
    5. Median time to close 1.1 days first maintainer reply 6.5 hours
    6. Open backlog 187 of 350 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 187
    3. Contributors / month 1
    4. Commits / month 1
    5. Stars 23,413
    Issue themes, last 12 months
    • questions 25%
    • other 75%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    browse all tools → score card for your toolchain →