Slim.AI helps builders optimize and safe their containers

Slim.AI, a startup specializing in software program provide chain safety, helps companies optimize and safe their software program containers, right this moment introduced the launch of its automated container hardening function on the CNCF’s KubeCon/CloudNativeCon Europe. With this, Slim can now routinely scan an organization’s containers for vulnerabilities and take away pointless information, libraries and different assault surfaces.

Constructed into current CI/CD pipelines, Slim’s new automated container hardening service runs containers, which a developer has beforehand instrumented, by means of the corporate’s current take a look at suite, analyzes them and routinely removes pointless information, leading to considerably smaller — and safer — containers. With fewer information in a container, this additionally signifies that builders can then concentrate on the vulnerability alerts that really matter, as a result of they relate to libraries which might be really getting used.

Slim.AI was born out of an open-source undertaking, the Slim Toolkit (which was beforehand known as DockerSlim). This undertaking is now seven years outdated and has seen over one million downloads. And whereas it does some rudimentary hardening and container safety evaluation, the crew shaped an organization to construct on their learnings from the Slim Toolkit and increase upon them.

As Slim.AI co-founder and CEO John Amaral advised me, when the corporate launched again in 2020, its focus was extra on offering customers with what Amaral known as an “MRI machine for containers” that might inform customers precisely what was of their containers and the place there have been potential safety points.

“One piece of suggestions we bought from the customers of our open-source technology was that they actually wanted to perceive what’s inside these containers as a complement to any variety of automated remediation,” Amaral stated. “The builders nonetheless want to be in a position to help these modified containers and if they don’t have a clear image of what’s there, then how will they be in a position to work together with the remaining parts? We spent a lot of time constructing higher tooling for them.”

As with all automated course of, issues don’t all the time work as deliberate and sometimes, the system could generate a container that misses a essential file. For these circumstances, Slim.AI offers builders and safety groups not solely loads of information about what it does to each container, but in addition the guide controls to repeat checks or exclude sure information.

“As engineering groups are more and more tasked with the tasks of constructing and releasing safe software program—whereas many organizations additionally look to developer velocity to drive enterprise outcomes—the proper tooling turns into all that extra important,” stated Kelly Fitzpatrick, senior business analyst at RedMonk. “By integrating container vulnerability discount and mitigation into the CI/CD processes that groups already use, Slim.AI’s automated container hardening is designed to unravel this want.”

The brand new service is on the market at no cost to customers of Slim.AI’s developer platform, although groups that plan to make use of the service at scale will in all probability wish to attain out to the corporate about its design associate program.