SYSTEMS, METHODS, AND COMPUTER-READABLE MEDIA FOR THINNING BLOATED CONTAINERS
Systems, methods, and computer-readable media for thinning bloated containers are described herein. A thinning module may identify one or more dependencies of a container that are not needed by application and can cause the one or more identified dependencies to be removed. In some embodiments, the thinning module can generate a script that removes the identified one or more dependencies from the container to produce a thinned container. The thinned container can then be used by an application that employs that container. The script can be generated for commonly used containers that are used across an organization. Recommendations to use commercially available containers in lieu of a thinned container can be made to users in charge of maintaining containers being used by applications in their organization.
1 . A system, comprising:
a server for running a thinning module service in conjunction with a telemetry interception and analysis platform (TIAP) that instruments at least one container of a plurality of containers associated with an application being executed on a customer computer system;
wherein the thinning module service is operative to:
identify, with assistance of the TIAP, a comprehensive list of dependencies included in a first container of the plurality of containers;
apply a bloat filter to the comprehensive list of dependencies to identify a subset of dependencies derived from the comprehensive list of dependencies that can be removed from the first container;
generate a script operative to remove the subset of dependencies from the first container; and
notify a user of the TIAP of the script and enable the user to execute the script, wherein execution of the script removes the subset of dependencies from the first container to produce a thinned container.
2 . The system of claim 1 , wherein the TIAP is operative to:
execute the script to remove the subset of dependencies from the first container to produce the thinned container; and
execute the application on the customer computer system using the thinned container.
3 . The system of claim 1 , wherein the TIAP is operative to display the subset of dependencies in a user interface.
4 . The system of claim 1 , wherein the bloat filter identifies dependencies that are not used by the application.
5 . The system of claim 1 , wherein the bloat filter identifies dependencies that have expired certificates of authenticity.
6 . The system of claim 1 , wherein the bloat filter identifies dependencies that are associated with common vulnerabilities and exposures.
7 . The system of claim 1 , wherein the thinning module service is further operative to:
determine that the first container is commonly used by the application and a plurality of other applications, wherein the application uses a first container image and each of the plurality of other applications uses respective common container images; and
wherein the script is operative to remove the subset of dependencies from the first container image and each of the common container images to produce the thinned container images thereof.
8 . The system of claim 7 , wherein the TIAP is operative to execute the script to remove the subset of dependencies from the first container image and each of the common container images to produce the thinned container images thereof.
9 . The system of claim 1 , wherein the thinning module service is further operative to:
access a library of commercially available containers;
compare the thinned container to the library of commercially available containers to determine if any one of the commercially available containers can be used in lieu of the thinned container; and
recommend to a user, via the TIAP, at least one commercially available container to be used in lieu of the thinned container.
10 . The system of claim 1 , wherein the thinning module service is further operative to:
apply the bloat filter to identify at least one dependency that is flagged as being critical to operation of the application but should be removed;
recommend a replacement dependency for the at least one dependency that is flagged as being critical to operation of the application, wherein the replacement dependency is functionally similar to the flagged dependency; and
generate a script operative to replace each flagged dependency with the recommended dependency.
11 . A system, comprising:
a first server comprising a first processor to run a telemetry interception and analysis platform (TIAP) comprising an event service operative to receive telemetry events from a TIAP runtime being executed on a customer computer system in conjunction with an application being executed on the customer computer system, wherein the application is associated with a plurality of containers that are potentially deployed during execution of the application, and wherein each of the plurality of containers comprises a plurality of dependencies; and
a second server comprising a second processor to run a thinning module operative to trim at least one dependency from at least one of the containers, wherein the thinning module is operative to:
identify, for a first container of the plurality of containers, a subset of dependencies derived from the plurality of dependencies that can be removed from the first container, wherein the subset of dependencies is identified through application at least one filter;
generate a script operative to remove the subset of dependencies from the first container; and
notify a user of the TIAP of the script and enable the user to execute the script, wherein execution of the script removes the subset of dependencies from the first container to produce a thinned container.
12 . The system of claim 11 , wherein the TIAP is operative to:
execute the script to remove the subset of dependencies from the first container to produce the thinned container; and
execute the application on the customer computer system using the thinned container.
13 . The system of claim 11 , wherein the at least one filter identifies dependencies that are not used by the application, identifies dependencies that have expired certificates of authenticity, identifies dependencies that are associated with common vulnerabilities and exposures, or any combination thereof.
14 . The system of claim 11 , wherein the thinning module service is further operative to:
determine that the first container is commonly used by the application and a plurality of other applications, wherein the application uses a first container image and each of the plurality of other applications uses respective common container images;
wherein the script is operative to remove the subset of dependencies from the first container image and each of the common container images to produce the thinned container images thereof; and
wherein the TIAP is operative to execute the script to remove the subset of dependencies from the first container image and each of the common container images to produce the thinned container images thereof.
15 . The system of claim 11 , wherein the thinning module service is further operative to:
access a library of commercially available containers;
compare the thinned container to the library of commercially available containers to determine if any one of the commercially available containers can be used in lieu of the thinned container; and
recommend to a user, via the TIAP, at least one commercially available container to be used in lieu of the thinned container.
16 . A method for thinning bloated containers in conjunction with a telemetry interception and analysis platform (TIAP) comprising:
identifying, with assistance of the TIAP, a comprehensive list of dependencies included in a first container of the plurality of containers;
applying a bloat filter to the comprehensive list of dependencies to identify a subset of dependencies derived from the comprehensive list of dependencies that can be removed from the first container;
generating a script operative to remove the subset of dependencies from the first container; and
notifying a user of the TIAP of the script and enable the user to execute the script, wherein execution of the script removes the subset of dependencies from the first container to produce a thinned container.
17 . The method of claim 16 , further comprising:
executing the script to remove the subset of dependencies from the first container to produce the thinned container; and
executing the application on the customer computer system using the thinned container.
18 . The method of claim 16 , wherein the bloat filter identifies dependencies that are not used by the application, identifies dependencies that have expired certificates of authenticity, identifies dependencies that are associated with common vulnerabilities and exposures, or any combination thereof.
19 . The method of claim 16 , further comprising:
determining that the first container is commonly used by the application and a plurality of other applications, wherein the application uses a first container image and each of the plurality of other applications uses respective common container images;
removing, via the script, the subset of dependencies from the first container image and each of the common container images to produce the thinned container images thereof; and
executing the script to remove the subset of dependencies from the first container image and each of the common container images to produce the thinned container images thereof.
20 . The system of claim 16 , further comprising:
accessing a library of commercially available containers;
comparing the thinned container to the library of commercially available containers to determine if any one of the commercially available containers can be used in lieu of the thinned container; and
recommending to a user, via the TIAP, at least one commercially available container to be used in lieu of the thinned container.