Container image size reduction via runtime analysis
An example method of reducing a container image size includes tracing an execution of a process running in a container. The container is associated with a first container image storing a set of files. The method also includes marking, based on the tracing, a subset of files accessed by the process. The method further includes creating a second container image storing the marked set of files.
1. A method, comprising:
identifying one or more files accessed by a process running in a container, the container being associated with a first container image storing a set of files; and
creating, based on the identifying, a second container image storing the one or more files.
2. The method of claim 1 , wherein the set of files includes at least one configuration file specifying the process to execute in the container.
3. The method of claim 1 , wherein the set of files includes at least one configuration file that specifies an entry point and one or more mount points of the container.
4. The method of claim 3 , further comprising:
determining a new mount point of the container, the new mount point being from a path of a host that shares a kernel with the container;
creating a new configuration file specifying the new mount point as a modified entry point of the container; and
analyzing the process in accordance with the modified entry point of the container.
5. The method of claim 4 , wherein the identifying the one or more files includes identifying, based on analyzing the process, the one or more files accessed by the process running in the container.
6. The method of claim 1 , wherein the identifying one or more files includes identifying a file that is read by the process running in the container.
7. The method of claim 1 , wherein the identifying one or more files includes identifying a file that is modified by the process running in the container.
8. The method of claim 1 , wherein the second container image is devoid of files that have not been identified as being accessed by the process running in the container.
9. The method of claim 1 , wherein a size of the first container image is larger than a size of the second container image.
10. The method of claim 1 , further comprising:
adding a second set of files specified in a whitelist to the second container image, wherein at least one file specified in the whitelist is not accessed by the process at runtime.
11. The method of claim 1 , further comprising:
removing a third set of files specified in a blacklist from the second container image, wherein at least one file specified in the blacklist is accessed by the process at runtime.
12. A system, comprising:
a profiler that identifies one or more files accessed by a process running in a container, wherein the container is associated with a first container image storing a set of files; and
a container image manager that creates, based on the identified one or more files, a second container image storing the one or more files.
13. The system of claim 12 , wherein the second container image is devoid of files that have not been identified as being accessed by the process running in the container.
14. The system of claim 12 , wherein a size of the first container image is larger than a size of the second container image.
15. The system of claim 12 , wherein the container image manager adds a second set of files specified in a whitelist to the second container image, wherein at least one file specified in the whitelist is not accessed by the process at runtime.
16. The system of claim 15 , wherein one or more files in the second set of files is specified by a user.
17. The system of claim 12 , wherein the container image manager removes a third set of files specified in a blacklist from the second container image, wherein at least one file specified in the blacklist is accessed by the process at runtime.
18. The system of claim 17 , wherein one or more files in the third set of files is specified by a user.
19. A machine-readable medium comprising a plurality of machine-readable instructions that when executed by one or more processors is adapted to cause the one or more processors to perform a method comprising:
identifying one or more files accessed by a process running in a container, the container being associated with a first container image storing a set of files; and
creating, based on the identifying, a second container image storing the one or more files.
20. The machine-readable medium of claim 19 , wherein a size of the first container image is larger than a size of the second container image.