harshhaareddy/slimify repository overview

brew install NotHarshhaa/tap/slimify

go install github.com/NotHarshhaa/slimify@latest

curl -sSfL https://raw.githubusercontent.com/NotHarshhaa/slimify/main/install.sh | sh

# GitHub Container Registry
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
  ghcr.io/notharshhaa/slimify audit myapp:latest

# Docker Hub
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
  harshhaareddy/slimify audit myapp:latest

# Audit any image — no config needed
slimify audit myapp:latest

# Get a full fix: rewritten Dockerfile + .dockerignore
slimify fix myapp:latest --dockerfile ./Dockerfile

# Audit a remote image without pulling first
slimify audit node:20-alpine --remote

$ slimify audit myapp:latest

  slimify audit — myapp:latest
  ─────────────────────────────────────────────────────

  Image size:        847 MB
  Layers:            5
  Potential savings: 312 MB  (36%)
  Ecosystem detected: Node.js(npm), Python(pip)

  ⚠  SECRETS DETECTED IN IMAGE LAYERS:
       .env
     These files should NEVER be baked into an image.
     Add them to .dockerignore and rotate any exposed credentials.

  Layer breakdown:
  ┌───┬──────────────────────────────────────┬──────────┬───────┬──────────┐
  │ # │ Instruction                          │ Size     │ Files │ Delta    │
  ├───┼──────────────────────────────────────┼──────────┼───────┼──────────┤
  │ 0 │ FROM node:20                         │  342 MB  │  4821 │ baseline │
  │ 1 │ RUN apt-get install -y build-essenti │   61 MB  │   312 │ +61 MB   │
  │ 2 │ COPY . .                             │  218 MB  │  1843 │ +218 MB  │
  │ 3 │ RUN npm install                      │  187 MB  │ 24891 │ +187 MB  │
  │ 4 │ RUN npm run build                    │   39 MB  │   521 │ +39 MB   │
  └───┴──────────────────────────────────────┴──────────┴───────┴──────────┘

  Top offenders in COPY . . :
    node_modules/       182 MB
    .git/                28 MB
    coverage/           4.2 MB
    *.map files         2.1 MB

  Duplicate files across layers:
    package-lock.json   copied in layer 2 and layer 3 — consolidate

  Recommendations:
    [1] Switch to multi-stage build (Node.js)      → save ~187 MB
    [2] Use node:20-alpine as base                 → save ~95 MB
    [3] Generate .dockerignore (run slimify fix)   → save ~34 MB from COPY context
    [4] Merge RUN apt-get + cleanup in one layer   → save ~18 MB

  Run `slimify fix myapp:latest --dockerfile ./Dockerfile` to apply all fixes.

slimify fix myapp:latest --dockerfile ./Dockerfile --out ./slimify-out/

  slimify fix — myapp:latest
  ─────────────────────────────────────────────────────

  ✓ Generated .dockerignore         (removes 34 MB from build context)
  ✓ Rewritten Dockerfile            (multi-stage, alpine base)
  ✓ Estimated new image size: 198 MB  (was 847 MB — 76% smaller)

  Output written to ./slimify-out/
    ├── Dockerfile.slimified
    ├── .dockerignore
    └── slimify.yaml

slimify compare myapp:v1.0 myapp:v2.0

# Compare remote images without pulling
slimify compare myapp:v1.0 myapp:v2.0 --remote

  slimify compare
  ─────────────────────────────────────────────────────

  Image A:  myapp:v1.0                   847 MiB
  Image B:  myapp:v2.0                   198 MiB

  ▼ Reduction:  649 MiB (76.7% smaller)

  Layers A → B:    12 → 5
  New layers in B:       3
  Removed layers in B:   7
  Shared base layers:    2

# Auto-detect ecosystem and generate
slimify ignore

# Write directly to file
slimify ignore > .dockerignore

# Update existing file, preserving custom rules
slimify ignore --write .dockerignore

# Force a specific ecosystem
slimify ignore --ecosystem go,node,php

# Scan a subdirectory (useful in monorepos)
slimify ignore --dir ./services/api

# slimify.yaml

ignore:
  whitelist:
    - bin/            # don't ignore this even if detected as bloat
    - config/prod/
  blacklist:
    - node_modules/.cache/puppeteer  # always ignore, even if not auto-detected

audit:
  threshold_mb: 2             # flag files larger than 2 MB
  top_files_per_layer: 20

fix:
  base_image: node:20-alpine  # override auto-selected base
  multi_stage: true           # always rewrite as multi-stage
  output_dir: ./docker/

- name: Audit Docker image
  uses: NotHarshhaa/slimify-action@v1
  with:
    image: myapp:${{ github.sha }}
    fail-if-savings-above: 100  # fail PR if >100 MB of bloat detected

- name: Comment savings report on PR
  uses: NotHarshhaa/slimify-action@v1
  with:
    image: myapp:${{ github.sha }}
    comment-on-pr: true

# Native exit-code gate — no jq needed
slimify audit myapp:latest --exit-code --threshold 100

# Or parse JSON output manually
slimify audit myapp:latest --json | jq -e '.savings_mb < 100'

# Also check for secrets in CI
slimify audit myapp:latest --json | jq -e '.secret_files | length == 0'

git clone https://github.com/NotHarshhaa/slimify
cd slimify
go mod tidy
go run . audit --help