Check for unused/uncessary packages in Docker

user_18112948 0
Viewed 153

TL;DR: Is there an convenient way to scan docker images for unused/unnecessary packages.

Question: Given an enormous list of docker images & files, is it possible to scan them and check whether or not a package is activity being used? For the purpose of security, it would be best to remove all unnecessary packages and reduce any attack surface. In particularly large applications it's not uncommon for a developer to accidentally leave behind a previously useful package.

Potential dirty approach: Remove packages one by one, if the application fails to build then we put that package back and can consider it necessary. However, if the docker file builds successfully it could trigger a notification indicating that the package was potentially unused.

dockerfile docker-compose docker scanning package
1 Answers

Concerning the unsued image, you can use the command docker image prune.

Here a link to the documentation that might help you.

nabil@LAPTOP:~$ docker image help

Usage:  docker image COMMAND

Manage images

Commands:
  build       Build an image from a Dockerfile
  history     Show the history of an image
  import      Import the contents from a tarball to create a filesystem image
  inspect     Display detailed information on one or more images
  load        Load an image from a tar archive or STDIN
  ls          List images
  prune       Remove unused images
  pull        Pull an image or a repository from a registry
  push        Push an image or a repository to a registry
  rm          Remove one or more images
  save        Save one or more images to a tar archive (streamed to STDOUT by default)
  tag         Create a tag TARGET_IMAGE that refers to SOURCE_IMAGE

Run 'docker image COMMAND --help' for more information on a command.
user_177662950
Related