Optimize Your Experience with Containers. Make Your Containers Better, Smaller, More Secure and Do Less to Get There (free and open source!)

Note that DockerSlim is now MinToolkit or just Mint (it was also called SlimToolkit, but that name was too similar to a commercial company name and using a different name was a CNCF requirement for the project). It's no longer limited only to the Docker runtime and its support for additional container runtimes and tools is growing. The "min" part of the name represents the ability to create minimal container images, which is now the unofficial defacto name to call slim images. "min" is also short for minify. The "T" part is short for "toolkit". Together min and t is a good way to describe the core functionality where the tool mints/creates new and improved container images.

Mint was created by Kyle Quest and it's been improved by many contributors. New contributors are always welcome and the project is commited to providing more resources and support to make it easy to contribute.

Overview

Mint allows developers to inspect, optimize and debug their containers using its xray, slim (aka build), debug, lint, run, images, imagebuild, merge, registry, vulnerability (and other) commands. It simplifies and improves your developer experience building, customizing and using containers. It makes your containers better, smaller and more secure while providing advanced visibility and improved usability working with the original and minified containers.

Don't change anything in your container image and minify it by up to 30x making it secure too! Optimizing images isn't the only thing it can do though. It can also help you understand and author better container images.

Keep doing what you are doing. No need to change anything. Use the base image you want. Use the package manager you want. Don't worry about hand optimizing your Dockerfile. You shouldn't have to throw away your tools and your workflow to have small container images.

Don't worry about manually creating Seccomp and AppArmor security profiles. You shouldn't have to become an expert in Linux syscalls, Seccomp and AppArmor to have secure containers. Even if you do know enough about it wasting time reverse engineering your application behavior can be time-consuming.

Mint will optimize and secure your containers by understanding your application and what it needs using various analysis techniques. It will throw away what you don't need, reducing the attack surface of your container. What if you need some of those extra things to debug your container? You can use dedicated debugging side-car containers for that (more details below).

Mint has been used with Node.js, Python, Ruby, Java, Go, Rust, Elixir and PHP (some app types) running on Ubuntu, Debian, CentOS, Alpine and even Distroless.

Note that some application stacks do require advanced container probing to make sure that all dynamically loaded components are detected. See the --http-probe* flags for more details to know how you can define custom probe commands. In some cases you might also need to use the --include-path flag to make sure everything your application needs is included (e.g., ubuntu.com python SPA app container image example where the client side template files are explicitly included).

It's also a good idea to use your app/environment tests when you run the Mint app. See the --continue-after flag for more details about integrating your tests with the temporary container Mint creates when it's doing its dynamic analysis. Running tests in the target container is also an option, but it does require you to specify a custom ENTRYPOINT/CMD with a custom wrapper to start your app and to execute your tests.

Interactive CLI prompt screencast:

Watch this screencast to see how an application image is minified by more than 30x.

When you run the slim (aka build) or profile commands in Mint it gives you an opportunity to interact with the temporary container it creates. By default, it will pause and wait for your input before it continues its execution. You can change this behavior using the --continue-after flag.

If your application exposes any web interfaces (e.g., when you have a web server or an HTTP API), you'll see the port numbers on the host machine you will need to use to interact with your application (look for the port.list and target.port.info messages on the screen). For example, in the screencast above you'll see that the internal application port 8000 is mapped to port 32911 on your host.

Note that Mint will interact with your application for you when HTTP probing is enabled (enabled by default; see the --http-probe* flag docs for more details). Some web applications built with scripting languages like Python or Ruby require service interactions to load everything in the application. Enable HTTP probing unless it gets in your way.

You can also interact with the temporary container via a shell script or snippet using --exec-file or --exec. For example, you can create a container which is only capable of using curl.

>> mint slim --target archlinux:latest --tag archlinux:curl --http-probe=false --exec "curl checkip.amazonaws.com"
...

>> docker run archlinux:curl curl checkip.amazonaws.com
...

>> docker images
archlinux                 curl                ...        ...         17.4MB
archlinux                 latest              ...        ...         467MB
...

Community

Feel free to join any of these channels or just open a new Github issue if you want to chat or if you need help.

Mint on the Internet

Books:

Everyone's Docker/Kubernetes (Japanese)
Docker in Practice (2nd edition)
Docker/Kubernetes Security Practice Guide (Japanese)

Minification Examples

You can find the examples in a separate repository: https://github.com/mintoolkit/examples

Node.js application images:

from ubuntu:14.04 - 432MB => 14MB (minified by 30.85X)
from debian:jessie - 406MB => 25.1MB (minified by 16.21X)
from node:alpine - 66.7MB => 34.7MB (minified by 1.92X)
from node:distroless - 72.7MB => 39.7MB (minified by 1.83X)

Python application images:

from ubuntu:14.04 - 438MB => 16.8MB (minified by 25.99X)
from python:2.7-alpine - 84.3MB => 23.1MB (minified by 3.65X)
from python:2.7.15 - 916MB => 27.5MB (minified by 33.29X)
from centos:7 - 647MB => 23MB (minified by 28.57X)
from centos/python-27-centos7 - 700MB => 24MB (minified by 29.01X)
from python2.7:distroless - 60.7MB => 18.3MB (minified by 3.32X)

Ruby application images:

from ubuntu:14.04 - 433MB => 13.8MB (minified by 31.31X)
from ruby:2.2-alpine - 319MB => 27MB (minified by 11.88X)
from ruby:2.5.3 - 978MB => 30MB (minified by 32.74X)

Go application images:

from golang:latest - 700MB => 1.56MB (minified by 448.76X)
from ubuntu:14.04 - 531MB => 1.87MB (minified by 284.10X)
from golang:alpine - 258MB => 1.56MB (minified by 165.61X)
from centos:7 - 615MB => 1.87MB (minified by 329.14X)

Rust application images:

from rust:1.31 - 2GB => 14MB (minified by 147.16X)

Java application images:

from ubuntu:14.04 - 743.6 MB => 100.3 MB

PHP application images:

from php:7.0-cli - 368MB => 26.6MB (minified by 13.85X)

Haskell application images:

(Scotty service) from haskell:8 - 2.09GB => 16.6MB (minified by 125.32X)
(Scotty service) from haskell:7 - 1.5GB => 21MB (minified by 71X)

Elixir application images:

(Phoenix service) from elixir:1.6 - 1.1 GB => 37 MB (minified by 29.25X)

RECENT UPDATES
INSTALLATION
BASIC USAGE INFO
COMMANDS
USAGE DETAILS
- LINT COMMAND OPTIONS
- XRAY COMMAND OPTIONS
- SLIM (aka BUILD) COMMAND OPTIONS
- DEBUG COMMAND OPTIONS
- IMAGEBUILD COMMAND OPTIONS
- RUN COMMAND OPTIONS
- REGISTRY COMMAND OPTIONS
- VULNERABILITY COMMAND OPTIONS
RUNNING CONTAINERIZED
DOCKER CONNECT OPTIONS
HTTP PROBE COMMANDS
DEBUGGING MINIFIED CONTAINERS
MINIFYING COMMAND LINE TOOLS
QUICK SECCOMP EXAMPLE
USING AUTO-GENERATED SECCOMP PROFILES
ORIGINAL DEMO VIDEO
DEMO STEPS
FAQ
- Is it safe for production use?
- How can I contribute if I don't know Go?
- What's the best application for Mint?
- Can I use Mint with dockerized command line tools?
- What if my Docker images uses the USER command?
- Nginx fails in my minified image
- Mint fails with a 'no permission to read from' error
EXPLORE SOURCE CODE WITH AI
BUILD PROCESS
- Build Steps
CONTRIBUTING
DESIGN
- CORE CONCEPTS
- DYNAMIC ANALYSIS OPTIONS
- SECURITY
- CHALLENGES
ORIGINS
MINIFIED IMAGES ON DOCKER HUB
LICENSE

RECENT UPDATES

Latest version: 1.41.7 (9/24/2024)

The 1.41.7 version adds the imagebuild command to build container images using different build engines and it also adds a number of improvements with HTTP probing.

For more info about the latest release see the CHANGELOG.

INSTALLATION

If you already have Mint installed use the update command to get the latest version:

mint update

Downloads

Download the zip package for your platform.
- Latest Mac binaries (curl -L -o ds.zip https://github.com/mintoolkit/mint/releases/download/1.41.7/dist_mac.zip)
- Latest Mac M1 binaries (curl -L -o ds.zip https://github.com/mintoolkit/mint/releases/download/1.41.7/dist_mac_m1.zip))
- Latest Linux binaries (curl -L -o ds.tar.gz https://github.com/mintoolkit/mint/releases/download/1.41.7/dist_linux.tar.gz)
- Latest Linux ARM binaries (curl -L -o ds.tar.gz https://github.com/mintoolkit/mint/releases/download/1.41.7/dist_linux_arm.tar.gz)
- Latest Linux ARM64 binaries (curl -L -o ds.tar.gz https://github.com/mintoolkit/mint/releases/download/1.41.7/dist_linux_arm64.tar.gz)
Unzip the package and optionally move it to your bin directory.

Linux (for non-intel replace dist_linux with the platform-specific extracted path):

tar -xvf ds.tar.gz
mv  dist_linux/mint /usr/local/bin/
mv  dist_linux/mint-sensor /usr/local/bin/

Mac:

unzip ds.zip
mv  dist_mac/mint /usr/local/bin/
mv  dist_mac/mint-sensor /usr/local/bin/

Add the location where you unzipped the package to your PATH environment variable (optional).

If the directory where you extracted the binaries is not in your PATH then you'll need to run your Mint app binary from that directory.

Scripted Install

You can also use this script to install the current release of Mint on Linux (x86 and ARM) and macOS (x86 and Apple Silicon)

curl -sL https://raw.githubusercontent.com/mintoolkit/mint/master/scripts/install-mint.sh | sudo -E bash -

Homebrew

brew install docker-slim

The Homebrew installer: https://formulae.brew.sh/formula/docker-slim

Docker

docker pull mintoolkit/mint

See the RUNNING CONTAINERIZED section for more usage info.

BASIC USAGE INFO

If you don't specify any command mint will start in the interactive prompt mode.

COMMANDS

slim - Create a minimal container image for your selected image generating the supported security profiles. This is the most popular command. (aka build).
debug - Debug minimal or regular container images running in Docker, Podman, Kubernetes and ContainerD.
xray - Performs static analysis for the target container image (including 'reverse engineering' the Dockerfile for the image). Use this command if you want to know what's inside of your container image and what makes it fat.
lint - Analyzes container instructions in Dockerfiles (Docker image support is WIP).
registry - Execute registry operations (pull, push, copy, server).
profile - Performs basic container image analysis and dynamic container analysis, but it doesn't generate an optimized image.
run - Runs one or more containers (for now runs a single container similar to docker run).
merge - Merge two container images (optimized to merge minified images).
imagebuild - Build container image using selected build engine.
images - Get information about container images (example: mint --quiet images).
vulnerability - Execute vulnerability related tools and operations (epss).
app - Execute app management, maintenance, debugging and query operations (bom, version, remove-sensor-volumes, update, install operations).
help - Show the available commands and global flags.

Example: mint slim my/sample-app

See the USAGE DETAILS section for more details. Run mint help to get a high level overview of the available commands. Run mint COMMAND_NAME without any parameters and you'll get more information about that command (e.g., mint slim).

If you run mint without any parameters you'll get an interactive prompt that will provide suggestions about the available commands and flags. Tabs are used to show the available options, to autocomplete the parameters and to navigate the option menu (which you can also do with Up and Down arrows). Spaces are used to move to the next parameter and Enter is used to run the command. For more info about the interactive prompt see go-prompt.

USAGE DETAILS

mint [global options] command [command options] <target image ID or name>

Commands:

slim - Create a minimal container image for your selected image generating the supported security profiles. (aka build).
debug - Debug minimal or regular container images running in Docker, Podman, Kubernetes and ContainerD.
xray - Show what's in the container image and reverse engineer its Dockerfile.
lint - Lint the target Dockerfile (or image, in the future)
registry - Execute registry operations (pull, push, copy, server).
profile - Collect fat image information and generate a fat container report.
merge - Merge two container images (optimized to merge minified images).
imagebuild - Build container image using selected build engine.
images - Get information about container images.
vulnerability - Execute vulnerability related tools and operations (epss).
app - Execute app management, maintenance, debugging and query operations (bom, version, remove-sensor-volumes, update, install operations).
help - Show help info.

Global options:

--report - command report location (target location where to save the executed command results; slim.report.json by default; set it to off to disable)
--check-version - check if the current version is outdated
--version - print the version
--debug - enable debug logs
--verbose - enable info logs
--log-level - set the logging level ('debug', 'info', 'warn' (default), 'error', 'fatal', 'panic')
--log-format - set the format used by logs ('text' (default), or 'json')
--crt-api-version - Container runtime API version, right now applies only to the Docker runtime API version (default: 1.32)
--quiet - less verbose CLI execution mode
--output-format - set the output format to use ('text' (default), or 'json')
--log - log file to store logs
--host - Docker host address or socket (prefix with tcp:// or unix://)
--crt-connection - Container runtime connection (for non-Docker runtimes / for Docker user --host)
--crt-context - Container runtime context name if supported (for Docker similar to setting '--context' or DOCKER_CONTEXT)
--tls - use TLS connecting to Docker
--tls-verify - do TLS verification
--tls-cert-path - path to TLS cert files
--state-path value - Mint state base path (must set it if the Mint binaries are not in a writable directory!)
--archive-state - Archives Mint state to the selected Docker volume (default volume - mint-state). By default, enabled when Mint is running in a container (disabled otherwise). Set it to off to disable explicitly.
--in-container - Set it to true to explicitly indicate that Mint is running in a container (if it's not set Mint will try to analyze the environment where it's running to determine if it's containerized)

To disable the version checks set the global --check-version flag to false (e.g., --check-version=false) or you can use the DSLIM_CHECK_VERSION environment variable.

`LINT` COMMAND OPTIONS

--target - target Dockerfile path (or Docker image, in the future; if you don't use this flag you must specify the target as the argument to the command)
--target-type - explicitly specify the command target type (values: dockerfile, image)
--skip-build-context - don't try to analyze build context
--build-context-dir - explicitly specify the build context directory
--skip-dockerignore - don't try to analyze .dockerignore
--include-check-label - include checks with the selected label key:value
--exclude-check-label - exclude checks with the selected label key:value
--include-check-id - check ID to include
--include-check-id-file - file with check IDs to include
--exclude-check-id - check ID to exclude
--exclude-check-id-file - file with check IDs to exclude
--show-nohits - show checks with no matches
--show-snippet - show check match snippet (default value: true)
--list-checks - list available checks (don't need to specify the target flag if you just want to list the available checks)

`XRAY` COMMAND OPTIONS

--runtime - Runtime environment type (values: docker, podman and a special meta runtime auto, which auto-selects the runtime based on the installed runtime; defaults to auto)
--target - Target container image (name or ID)
--pull - Try pulling target if it's not available locally (default: false).
--docker-config-path - Set the docker config path used to fetch registry credentials (used with the --pull flag).
--registry-account - Account to be used when pulling images from private registries (used with the --pull flag).
--registry-secret - Account secret to be used when pulling images from private registries (used with the --pull and --registry-account flags).
--show-plogs - Show image pull logs (default: false).
--changes value - Show layer change details for the selected change type (values: none, all, delete, modify, add).
--changes-output value - Where to show the changes (values: all, report, console).
--layer value - Show details for the selected layer (using layer index or ID)
--add-image-manifest - Add raw image manifest to the command execution report file
--add-image-config - Add raw image config object to the command execution report file
--layer-changes-max - Maximum number of changes to show for each layer
--all-changes-max - Maximum number of changes to show for all layers
--add-changes-max - Maximum number of add changes to show for all layers
--modify-changes-max - Maximum number of modify changes to show for all layers
--delete-changes-max - Maximum number of delete changes to show for all layers
--change-path value - Include changes for the files that match the path pattern (Glob/Match in Go and **). Value formats: <path pattern> | dump:<output type>:<path pattern> | ::<path pattern> where output type is console or a directory name. If value starts with dump: the match will be 'dumped' to the selected output type. [can use this flag multiple times]
--change-data value - Include changes for the files that match the data pattern (regex). Value formats: <data regex> | dump:<output type>:<path pattern>:<data regex> | ::<path pattern>:<data regex> | :::<data regex> where output type is console or a directory name. If value starts with dump: the match will be 'dumped' to the selected output type. [can use this flag multiple times]
--change-data-hash value - Include changes for the files that match the provided data hashes (sha1). Value formats: <sha1 hash> | dump:<output type>:<sha1 hash> | ::<sha1 hash> where output type is console or a directory name. If value starts with dump: the match will be 'dumped' to the selected output type. [can use this flag multiple times]
--reuse-saved-image - Reuse saved container image (default: true).
--top-changes-max - Maximum number of top changes to track (defalt: 20).
--hash-data - Generate file data hashes (default: false).
--detect-duplicates - Detect duplicate files based on their hashes (default: true).
--show-duplicates - Show all discovered duplicate file paths (default: false).
--show-special-perms - Show files with special permissions (setuid,setgid,sticky) (default: true)
--detect-utf8 - Detect utf8 files and optionally extract the discovered utf8 file content (possible values: "true" or "dump" or "dump:output_target.tgz" or "dump:output_target.tgz::max_size_bytes" or "dump:output_target.tgz:::max_size_bytes").
--detect-all-certs - Detect all certifcate files
--detect-all-cert-pks - Detect all certifcate private key files
--detect-identities - Detect system identities (users, groups) and their properties (default: true)
--change-match-layers-only - Show only layers with change matches (default: false).
--export-all-data-artifacts - TAR archive file path to export all text data artifacts (if value is set to . then the archive file path defaults to ./data-artifacts.tar)
--remove-file-artifacts - Remove file artifacts when command is done (note: you'll loose the reverse engineered Dockerfile)
--command-params-file - JSON file with all command parameters - the JSON file can use a snake case formatted commands example --docker-config-path would be docker_config_path

Change Types:

none - Don't show any file system change details in image layers (the top changes from the corresponding layer are still shown)
all - Show all file system change details in image layers
delete - Show only delete file system change details in image layers
modify - Show only modify file system change details in image layers
add - Show only 'add' file system change details in image layers

In the interactive CLI prompt mode you must specify the target image using the --target flag while in the traditional CLI mode you can use the --target flag or you can specify the target image as the last value in the command.

`SLIM` COMMAND OPTIONS

--target - Target container image (name or ID). It's an alternative way to provide the target information. The standard way to provide the target information is by putting the target image reference as the last value in the slim (aka build) command CLI call.
--pull - Try pulling target if it's not available locally (default: true).
--docker-config-path - Set the docker config path used to fetch registry credentials (used with the --pull flag).
--registry-account - Account to be used when pulling images from private registries (used with the --pull flag).
--registry-secret - Account secret to be used when pulling images from private registries (used with the --pull and --registry-account flags).
--show-plogs - Show image pull logs (default: false).
--compose-file - Load container info from selected compose file
--target-compose-svc - Target service from compose file
--target-compose-svc-image - Override the container image name and/or tag when targetting a compose service using the target-compose-svc parameter (format: tag_name or image_name:tag_name)
--target-compose-svc-no-ports - Do not publish ports for target service from compose file
--dep-exclude-compose-svc-all - Do not start any compose services as target dependencies
--dep-include-compose-svc - Include specific compose service as a target dependency (only selected services will be started)
--dep-exclude-compose-svc - Exclude specific service from the compose services that will be started as target dependencies
--dep-include-compose-svc-deps - Include all dependencies for the selected compose service (excluding the service itself) as target dependencies
--dep-include-target-compose-svc-deps - Include all dependencies for the target compose service (excluding the service itself) as target dependencies. This is a shortcut flag to avoid repeating the service name (it's a pretty long flag name though :-))
--compose-svc-start-wait - Number of seconds to wait before starting each compose service
--compose-net - Attach target to the selected compose network(s) otherwise all networks will be attached
--compose-env-nohost - Don't include the env vars from the host to compose
--compose-env-file - Load compose env vars from file (host env vars override the values loaded from this file)
--compose-workdir - Set custom work directory for compose
--compose-project-name - Use custom project name for compose
--container-probe-compose-svc - Container test/probe service from compose file
--prestart-compose-svc - placeholder for now
--poststart-compose-svc - placeholder for now
--http-probe - Enables/disables HTTP probing (ENABLED by default; you have to disable the probe if you don't need it by setting the flag to false: --http-probe=false)
--http-probe-off - Alternative way to disable HTTP probing
--http-probe-client-timeout - Probe network client timeout in seconds (defaults to 30 seconds)
--http-probe-client-timeout-crawl - Crawl probe network client timeout in seconds (defaults to probe network client timeout if set or internal default if not, 10 seconds)
--http-probe-cmd - User defined HTTP probe(s) as [[[[\"crawl\":]PROTO:]METHOD:]PATH] [can use this flag multiple times]
--http-probe-cmd-file - File with user defined HTTP probe commands
--http-probe-cmd-upload - User defined HTTP probe(s) to submit form data as [[[[[PROTO:]FORM_FILE_NAME:]FORM_FIELD_NAME:]FILE_OR_GENERATE_TYPE:]PATH] [can use this flag multiple times
--http-probe-start-wait - Number of seconds to wait before starting HTTP probing
--http-probe-retry-off - Disable retries for probes (alternative way to disable probes)
--http-probe-retry-count - Number of retries for each probe (set to -1 to disable probe retries / default value: 5)
--http-probe-retry-wait - Number of seconds to wait before retrying HTTP probe (doubles when target is not ready; default value: 8)
--http-probe-concurrency - Max number of concurrent requests executing HTTP probes (default value: 5)
--http-probe-ports - Explicit list of ports to probe (in the order you want them to be probed; excluded ports are not probed!)
--http-probe-full - Do full HTTP probe for all selected ports (if false, finish after first successful scan; default value: true)
--http-probe-exit-on-failure - Exit when all HTTP probe commands fail (default value: true)
--http-probe-exit-on-failure-count - Exit when selected number of probe call failures happens
--http-probe-fail-on-status-5xx - Treat 5xx HTTP status codes as errors during HTTP probing
--http-probe-crawl - Enable crawling for the default HTTP probe command (default value: true)
--http-crawl-max-depth - Max depth to use for the HTTP probe crawler (default value: 3)
--http-crawl-max-page-count - Max number of pages to visit for the HTTP probe crawler (default value: 1000)
--http-crawl-concurrency - Number of concurrent workers when crawling an HTTP target (default value: 10)
--http-max-concurrent-crawlers - Number of concurrent crawlers in the HTTP probe (default value: 1)
--http-probe-apispec - Run HTTP probes for API spec where the value represents the target path where the spec is available (supports Swagger 2.x and OpenAPI 3.x) [can use this flag multiple times]
--http-probe-apispec-file - Run HTTP probes for API spec from file (supports Swagger 2.x and OpenAPI 3.x) [can use this flag multiple times]
--http-probe-exec - App to execute when running HTTP probes. [can use this flag multiple times]
--http-probe-exec-file - Apps to execute when running HTTP probes loaded from file.
--publish-port - Map container port to host port analyzing image at runtime to make it easier to integrate external tests (format => port | hostPort:containerPort | hostIP:hostPort:containerPort | hostIP::containerPort )[can use this flag multiple times]
--publish-exposed-ports - Map all exposed ports to the same host ports analyzing image at runtime (default value: false)
--show-clogs - Show container logs (from the container used to perform dynamic inspection)
--show-blogs - Show build logs (when the minified container is built)
--copy-meta-artifacts - Copy meta artifacts to the provided location
--remove-file-artifacts - Remove file artifacts when command is done (note: you'll loose autogenerated Seccomp and Apparmor profiles unless you copy them with the copy-meta-artifacts flag or if you archive the state)
--tag - Use a custom tag for the generated image (instead of the default value: <original_image_name>.slim) [can use this flag multiple times if you need to create additional tags for the optimized image]
--entrypoint - Override ENTRYPOINT analyzing image at runtime
--cmd - Override CMD analyzing image at runtime
--mount - Mount volume analyzing image (the mount parameter format is identical to the -v mount command in Docker) [can use this flag multiple times]
--include-path - Include directory (and what's in it) or file from image [can use this flag multiple times] (optionally overwriting the artifact's permissions, user and group information; full format: targetPath:octalPermFlags#uid#gid, mimimal format: targetPath ; see the non-default USER FAQ section for more details)
--include-path-file - Load directory or file includes from a file (optionally overwriting the artifact's permissions, user and group information; full format: targetPath:octalPermFlags#uid#gid, mimimal format: targetPath ; see the non-default USER FAQ section for more details)
--include-paths-creport-file - Keep files from the referenced creport
--include-bin value - Include binary from image (executable or shared object using its absolute path)
--include-bin-file - Load shared binary file includes from a file (similar to --include-path-file)
--include-dir-bins value - Include binaries in the target directory and include their dependencies, which could be in other locations (executables or shared objects using its absolute path)
--include-exe value - Include executable from image (by executable name)
--include-exe-file - Load executable file includes from a file (similar to --include-path-file)
--include-shell - Include basic shell functionality (default value: false)
--include-workdir - Keep files in working directory (default value: false)
--include-last-image-layers - Keep all files from the last number of layers in the image
--include-healthcheck - Keep the HEALTHCHECK related artifacts (default value: true)
--include-cert-all - Keep all discovered cert files (default: true)
--include-cert-bundles-only - Keep only cert bundles
--include-cert-dirs - Keep known cert directories and all files in them
--include-cert-pk-all - Keep all discovered cert private keys
--include-cert-pk-dirs - Keep known cert private key directories and all files in them
--include-new - Keep new files created by target during dynamic analysis (default value: true)
--include-distro-info - Keep OS distro metadata (default value: false)
--include-oslibs-net - Keep the common networking OS libraries (default value: true)
--include-ssh-client - Keep the common SSH client components and configs
--include-zoneinfo - Keep the OS/libc zoneinfo data (default value: false)
--include-app-nuxt-dir - Keep the root Nuxt.js app directory (default value: false)
--include-app-nuxt-build-dir - Keep the build Nuxt.js app directory (default value: false)
--include-app-nuxt-dist-dir - Keep the dist Nuxt.js app directory (default value: false)
--include-app-nuxt-static-dir - Keep the static asset directory for Nuxt.js apps (default value: false)
--include-app-nuxt-nodemodules-dir - Keep the node modules directory for Nuxt.js apps (default value: false)
--include-app-next-dir - Keep the root Next.js app directory (default value: false)
--include-app-next-build-dir - Keep the build directory for Next.js app (default value: false)
--include-app-next-dist-dir - Keep the static SPA directory for Next.js apps (default value: false)
--include-app-next-static-dir - Keep the static public asset directory for Next.js apps (default value: false)
--include-app-next-nodemodules-dir - Keep the node modules directory for Next.js apps (default value: false)
--include-node-package - Keep node.js package by name [can use this flag multiple times]
--preserve-path - Keep path from orignal image in its initial state (changes to the selected container image files when it runs will be discarded). [can use this flag multiple times]
--preserve-path-file - File with paths to keep from original image in their original state (changes to the selected container image files when it runs will be discarded).
--path-perms - Set path permissions/user/group in optimized image (format: target:octalPermFlags#uid#gid ; see the non-default USER FAQ section for more details)
--path-perms-file - File with path permissions to set (format: target:octalPermFlags#uid#gid ; see the non-default USER FAQ section for more details)
--exclude-pattern - Exclude path pattern (Glob/Match in Go and **) from image (useful when --include-path keeps a directory and you need to exclude / filter out some of the files in that directory)
--exclude-varlock-files - Exclude the files in the var and run lock directory (default value: true)
--exclude-mounts - Exclude mounted volumes from image (default value: true)
--label - Override or add LABEL analyzing image at runtime [can use this flag multiple times]
--volume - Add VOLUME analyzing image at runtime [can use this flag multiple times]
--env - Add ENV analyzing target image at runtime [can use this flag multiple times]
--env-file - Load multiple environment variables from a file when analyzing target image at runtime.
--workdir - Override WORKDIR analyzing image at runtime
--network - Override default container network settings analyzing image at runtime
--expose - Use additional EXPOSE instructions analyzing image at runtime [can use this flag multiple times]
--link - Add link to another container analyzing image at runtime [can use this flag multiple times]
--hostname - Override default container hostname analyzing image at runtime
--etc-hosts-map - Add a host to IP mapping to /etc/hosts analyzing image at runtime [can use this flag multiple times]
--container-dns - Add a dns server analyzing image at runtime [can use this flag multiple times]
--container-dns-search - Add a dns search domain for unqualified hostnames analyzing image at runtime [can use this flag multiple times]
--image-overrides - Save runtime overrides in generated image (values is all or a comma delimited list of override types: entrypoint, cmd, workdir, env, expose, volume, label). Use this flag if you need to set a runtime value and you want to persist it in the optimized image. If you only want to add, edit or delete an image value in the optimized image use one of the --new-* or --remove-* flags (define below).
--continue-after - Select continue mode: enter | signal | probe | exec | timeout-number-in-seconds | container.probe (default value if http probes are disabled: enter). You can also select probe and exec together: 'probe&exec' (make sure to use quotes around the two modes or the & will break the shell command).
--dockerfile - The source Dockerfile name to build the fat image before it's optimized.
--tag-fat - Custom tag for the fat image built from Dockerfile.
--cbo-add-host - Add an extra host-to-IP mapping in /etc/hosts to use when building an image (Container Build Option).
--cbo-build-arg - Add a build-time variable (Container Build Option).
--cbo-label - Add a label when building from Dockerfiles (Container Build Option).
--cbo-target - Target stage to build for multi-stage Dockerfiles (Container Build Option).
--cbo-network - Networking mode to use for the RUN instructions at build-time (Container Build Option).
--cbo-cache-from - Add an image to the build cache (Container Build Option).
--cro-runtime - Runtime to use with the created containers (Container Runtime Option).
--cro-host-config-file - File to load the Docker host configuration data (JSON format) to use when running the container. See the HostConfig struct definition from the go-dockerclient package for configuration details. Note that Mint will automatically add SYS_ADMIN to the list of capabilities and run the container in privileged mode, which are required to generate the seccomp profiles. The host config parameters specified using their standalone build or profile command flags overwrite the values in the host config file (volume binds are merged).
--cro-sysctl - Set namespaced kernel parameters in the created container (Container Runtime Option).
--cro-shm-size - Shared memory size for /dev/shm in the created container (Container Runtime Option).
--use-local-mounts - Mount local paths for target container artifact input and output (off, by default)
--use-sensor-volume - Sensor volume name to use (set it to your Docker volume name if you manage your own Mint sensor volume).
--keep-tmp-artifacts - Keep temporary artifacts when command is done (off, by default).
--keep-perms - Keep artifact permissions as-is (default: true)
--run-target-as-user - Run target app (in the temporary container) as USER from Dockerfile (true, by default)
--new-entrypoint - New ENTRYPOINT instruction for the optimized image
--new-cmd - New CMD instruction for the optimized image
--new-expose - New EXPOSE instructions for the optimized image
--new-workdir - New WORKDIR instruction for the optimized image
--new-env - New ENV instructions for the optimized image
--new-label - New LABEL instructions for the optimized image
--new-volume - New VOLUME instructions for the optimized image
--remove-volume - Remove VOLUME instructions for the optimized image
--remove-env - Remove ENV instructions for the optimized image
--remove-label - Remove LABEL instructions for the optimized image
--remove-expose - Remove EXPOSE instructions for the optimized image
--exec - A shell script snippet to run via Docker exec
--exec-file - A shell script file to run via Docker exec
--sensor-ipc-mode - Select sensor IPC mode: proxy | direct (useful for containerized CI/CD environments)
--sensor-ipc-endpoint - Override sensor IPC endpoint
--rta-onbuild-base-image - Enable runtime analysis for onbuild base images (default: false)
--rta-source-ptrace - Enable PTRACE runtime analysis source (default: true)
--image-build-engine - Select image build engine: internal | docker | none (internal - build the output image without using Docker [default behavior], docker - build the output image with Docker, none - don't build the output image, allows you to do your own build with the tools you want to use, which you'll be able to do by pointing to the artifact directory where the files.tar and Dockerfile artifacts are located for the output image)
--image-build-arch - Select output image build architecture (use the standard container image names for the architectures without the OS part)
--obfuscate-metadata - Obfuscate the operating system and application metadata to make it more challenging to identify the image components including OS and application packages. As a side effect using this flag will hide vulnerabilities from vulnerability scanners that rely on the OS and programming language specific package metadata to identify vulnerabilities in container images. This flag can be used to prevent vulnerability scanners from detecting vulnerabilities. This flag also prevents some SBOM generation tools from detecting operating system and application packages.
--obfuscate-app-package-names - Select the obfuscation mode for the application pack 559E age names. Available modes: none | empty | prefix | random (none - Do no app package name obfuscation; empty - Replace the app package names with empty values; prefix - Prefix app package names with a string; random - Replace app package names with random values). This flag changes package names, so the packages can't be recognized by vulnerability scanning and SBOM generation tools. The "empty" mode completely hides the packages from vulnerability scanners and from SBOM tools. This flag can be used with the --obfuscate-metadata flag.
--enable-mondel - Enable monitor data event log for sensor monitors to log/stream the events captured by those monitors (default: false)
--command-params-file - JSON file with all command parameters - the JSON file can use a snake case formatted commands example --docker-config-path would be docker_config_path

In the interactive CLI prompt mode you must specify the target image using the --target flag while in the traditional CLI mode you can use the --target flag or you can specify the target image as the last value in the command.

The --include-path option is useful if you want to customize your minified image adding extra files and directories. The --include-path-file option allows you to load multiple includes from a newline delimited file. Use this option if you have a lot of includes. The includes from --include-path and --include-path-file are combined together. You can also use the --exclude-pattern flag to control what shouldn't be included.

The --continue-after option is useful if you need to script the Mint app. If you pick the probe option then Mint will continue executing the build command after the HTTP probe is done executing. If you pick the exec options then Mint will continue executing the build command after the container exec shell commands (specified using the --exec-file or --exec flags) are done executing. If you pick the timeout option Mint will allow the target container to run for 60 seconds before it will attempt to collect the artifacts. You can specify a custom timeout value by passing a number of seconds you need instead of the timeout string. If you pick the signal option you'll need to send a USR1 signal to the Mint app process. The signal option is useful when you want to run your own tests against the temporary container Mint creates. Your test automation / CI/CD pipeline will be able to notify the Mint app that it's done running its test by sending the USR1 to it.

You can also combine multiple continue-after modes. For now only combining probe and exec is supported (using either probe&exec or exec&probe as the --continue-after flag value). Other combinations may work too. Combining probe and signal is not supported.

The --include-shell option provides a simple way to keep a basic shell in the minified container. Not all shell commands are included. To get additional shell commands or other command line utilities use the --include-exe and/or --include-bin options. Note that the extra apps and binaries might missed some of the non-binary dependencies (which don't get picked up during static analysis). For those additional dependencies use the --include-path and --include-path-file options.

The --dockerfile option makes it possible to build a new minified image directly from source Dockerfile. Pass the Dockerfile name as the value for this flag and pass the build context directory or URL instead of the docker image name as the last parameter for the build command: mint slim --dockerfile Dockerfile --tag my/custom_minified_image_name . If you want to see the console output from the build stages (when the fat and slim images are built) add the --show-blogs build flag. Note that the build console output is not interactive and it's printed only after the corresponding build step is done. The fat image created during the build process has the .fat suffix in its name. If you specify a custom image tag (with the --tag flag) the .fat suffix is added to the name part of the tag. If you don't provide a custom tag the generated fat image name will have the following format: slim-tmp-fat-image.<pid_of_slim>.<current_timestamp>. The minified image name will have the .slim suffix added to that auto-generated container image name (slim-tmp-fat-image.<pid_of_slim>.<current_timestamp>.slim). Take a look at this python examples to see how it's using the --dockerfile flag.

The --use-local-mounts option is used to choose how the Mint sensor is added to the target container and how the sensor artifacts are delivered back to the master. If you enable this option you'll get the original Mint app behavior where it uses local file system volume mounts to add the sensor executable and to extract the artifacts from the target container. This option doesn't always work as expected in the dockerized environment where Mint itself is running in a Docker container. When this option is disabled (default behavior) then a separate Docker volume is used to mount the sensor and the sensor artifacts are explicitly copied from the target container.

`DEBUG` COMMAND OPTIONS

Debug minimal or regular container images running in Docker, Podman, Kubernetes and ContainerD.

--runtime - Runtime environment type (values: docker, k8s, containerd, podman and a special meta runtime auto, which auto-selects the runtime based on the installed runtime; defaults to auto)
--debug-image - Debug image to use for the debug side-car container (default value for this flag is busybox). If you are using the interactive prompt mode you'll get a drop down list of all preselected debug images.
--list-debug-images - Show the built-in list of debug images to use for the debug sidecar container (with the --debug-image flag). You can use other images too. Use this flag by itself (no need to specify the --target flag).
--target - Target container name or ID (this can also be provided as the last param in the command line invocation of the debug command). Note that the target container must be running. If you are using the interactive prompt mode you'll get a drop down list of the currently running containers in the selected runtime.
--namespace - Namespace to target [k8s runtime] (defaults to default)
--pod - Pod to target [k8s runtime]
--cmd - (Optional) custom CMD to use for the debug side-car container (if you need to run CMD value in a shell use --shell-cmd or '--' instead).
--shell-cmd - (Optional) custom CMD to use as a shell command for the debug sidecar container (alternatively pass custom CMD params after '--').
--entrypoint - (Optional) custom ENTRYPOINT to use for the debug side-car container.
--terminal - Attach interactive terminal to the debug container (default: true). When the interactive terminal is not enabled the debug container output will be printed out to the screen when the debug command exits.
--kubeconfig - Kubeconfig file location [k8s runtime]
--workdir - Custom WORKDIR to use for the debug sidecar container.
--env - Environment variable to add to the debug sidecar container.
--load-target-env-vars - Load all (container spec) environment variables from the target container into the debug sidecar container (true by default; set it to false if you don't want this behavior).
--mount - Volume to mount in the debug sidecar container (format: name:path or name:path:ro).
--mount-target-volumes - Mount all volumes mounted in the target container to the debug sidecar container.
--uid - UID to use for the debugging sidecar container.
--gid - GID to use for the debugging sidecar container.
--run-privileged - Run the debug sidecar as a privileged container (true by default).
--security-context-from-target - Use the security context params from the target container with the debug sidecar container.
--fallback-to-target-user - Fallback to using target container user if it's non-root (true by default; set it to false to disable this behavior).
--run-as-target-shell - Attach an interactive terminal to the debug container and run shell as if it's running in the target container environment (true by default).
--list-sessions - List all debug sessions for the selected target (pod and optionally selected container for k8s or container for other runtimes).
--show-session-logs - Show logs for the selected debug session (using namespace, pod, target container or debug session container name for k8s or debug session container name for other runtimes).
--session - Debug session container name (used for debug sessoin actions).
--connect-session - Connect to existing debug session.
--list-namespaces - List names for available namespaces (use this flag by itself) [k8s runtime].
--list-pods - List names for running pods in the selected namespace (use this flag by itself) [k8s runtime].
--list-debuggable-containers - List container names for active containers that can be debugged (use this flag by itself).
--help show help (default: false)

See the "Debugging Using the debug Command" section for more information about this command.

`IMAGEBUILD` COMMAND OPTIONS

Build container image using selected build engine. The created image will be saved as a tar file. You can also load the new image into one of the supported runtimes.

USAGE: mint [GLOBAL FLAGS] imagebuild [FLAGS] [IMAGE]

Flags:

--engine - Container image build engine to use: docker (Native Docker container build engine), podman (Native Podman/Buildah container build engine), buildkit (BuildKit container build engine), depot (Depot.dev cloud-based container build engine).
--image-name - Container image name to use (including tag).
--image-archive-file - Local file path for the image tar archive file (used for the depot and buildkit engines).
--dockerfile - Local Dockerfile path (for buildkit and depot) or a relative to the build context directory (for docker or podman). Default: Dockerfile.
--context-dir - Local build context directory. Default: ..
--build-arg - Build time variable (ARG). [can use this flag multiple times]
--label - Image label to add. [can use this flag multiple times]
--architecture - Build architecture (amd64 or arm64).
--engine-endpoint - Build engine endpoint address (for buildkit).
--engine-token - Build engine specific API token (for depot).
--engine-namespace - Build engine specific namespace (for depot).
--runtime-load - Container runtime where to load the created image: none, docker, podman.

Examples:

An example showing how to use the cloud-based depot.dev build engine:

export DEPOT_TOKEN=your_token
export DEPOT_PROJECT_ID=your_project
mint imagebuild --engine depot --dockerfile Dockerfile --context-dir .

Another depot.dev engine example that also loads the created image into the local Docker instance:

mint imagebuild --engine depot --engine-token your_depot_token --engine-namespace your_depot_project --dockerfile Dockerfile --context-dir . --runtime-load docker

A BuildKit engine example that uses a local BuildKit instance running on tcp port 1234:

mint imagebuild --engine buildkit --engine-endpoint tcp://localhost:12345 --image-name imagebuild-buildkit-app:latest --dockerfile ./node_app/Dockerfile --context-dir ./node_app --runtime-load docker

With this BuildKit example the new image name is set to imagebuild-buildkit-app:latest. Make sure to use the --image-name flag if you don't want to use the default container image name.

Note that the --dockerfile flag is a path to the Dockerfile you want to use and it's not related to the context directory path provided with the --context-dir. This works for the depot and buildkit engines, but not for the docker or podman engines where the --dockerfile flag value is relative to the context directory.

A Podman engine example:

mint imagebuild --engine podman --image-name imagebuild-podman-app:latest --build-arg BA=1 --label LONE=value --label LTWO="label two value" --dockerfile Dockerfile --context-dir node_app

Note that this example also building the same image in the node_app directory, but here the --dockerfile flag value is set to Dockerfile. In this case, setting the --dockerfile flag was not necessary, because Dockerfile is the default --dockerfile flag value.

`RUN` COMMAND OPTIONS

Run one or more containers

USAGE: mint [GLOBAL FLAGS] run [FLAGS] [IMAGE]

Flags:

--target - Target container image to run. Same as specifying the target container image as the last value for the command. Used mostly for the interactive prompt mode where you need to select flag names.
--pull - Pull the target image before trying to run it.
--docker-config-path - Docker config path (used to fetch registry credentials).
--registry-account - Target registry account used when pulling images from private registries.
--registry-secret - Target registry secret used when pulling images from private registries.
--show-plogs - Show image pull logs.
--entrypoint - Override ENTRYPOINT running the target image.
--cmd - Override CMD running the target image.
--live-logs - Show live logs for the container (cant use with --terminal).
--terminal - Attach interactive terminal to the container.
--publish - Map container port to host port (format => port | hostPort:containerPort | hostIP:hostPort:containerPort | hostIP::containerPort ).
--rm - Remove the container when it exits.
--detach - Start the container and do not wait for it to exit.

`MERGE` COMMAND OPTIONS

Merge two container images. Optimized to merge minified images.

Flags:

--image - Image to merge. Flag instance position determines the merge order. The command supports two instances of this flag.
--use-last-image-metadata - Use only the last image metadata for the merged image.
--tag - Custom tags for the output image (multiple instances).

`REGISTRY` COMMAND OPTIONS

For the operations that require authentication you can reuse the registry credentials from Docker (do docker login first and then use the --use-docker-credentials flag with the registry command) or you can specify the auth info using the --account and --secret flags).

Current sub-commands: pull, push, image-index-create, server.

There's also a placeholder for copy, but it doesn't do anything yet. Great opportunity to contribute ;-)

Shared Command Level Flags:

--use-docker-credentials - Use the registry credentials from the default Docker config file.
--account - Registry credentials account.
--secret - Registry credentials secret.

`PULL` SUBCOMMAND OPTIONS

USAGE: mint [GLOBAL FLAGS] registry [SHARED FLAGS] pull [FLAGS] [IMAGE]

Flags:

--target value - Target container image (name or ID) [$DSLIM_TARGET]
--save-to-docker- Save pulled image to docker (default: true) [$DSLIM_REG_PULL_SAVE_TO_DOCKER]

`PUSH` SUBCOMMAND OPTIONS

USAGE: mint [GLOBAL FLAGS] registry [SHARED FLAGS] push [FLAGS] [IMAGE]

Flags:

--docker -- Push local docker image.
--tar -- Push image from a local tar file.
--as -- Tag the selected image with the specified name before pushing.

Note that mint registry push LOCAL_DOCKER_IMAGE_NAME is a shortcut for mint registry push --docker LOCAL_DOCKER_IMAGE_NAME.

Normally you have to explicitly tag the target image to have a name that's appropriate for the destination registry. The --as flag is a convinient way to tag the image while you are pushing it. Here's an example pushing a local Docker nginx image to a local registry: mint registry push --docker nginx --as localhost:5000/nginx

You can create a local registry using the server subcommand. See the server sub-command section below for more details.

`COPY` SUBCOMMAND OPTIONS

USAGE: mint registry copy [SRC_IMAGE] [DST_IMAGE]

NOTE: Just a placeholder for now (TBD)

Name		Name	Last commit message	Last commit date
Latest commit History 1,246 Commits
.github		.github
.vscode		.vscode
assets/images		assets/images
build/package		build/package
cmd		cmd
docs		docs
examples		examples
pkg		pkg
scripts		scripts
test		test
vendor		vendor
.deepsource.toml		.deepsource.toml
.dockerignore		.dockerignore
.gitignore		.gitignore
.gitmodules		.gitmodules
.gitpod.yml		.gitpod.yml
.markdownlint.json		.markdownlint.json
ADOPTERS.md		ADOPTERS.md
CHANGELOG.md		CHANGELOG.md
COMMUNITY_ACTIVITY_LOG.md		COMMUNITY_ACTIVITY_LOG.md
CONTRIBUTING.md		CONTRIBUTING.md
GOVERNANCE.md		GOVERNANCE.md
LICENSE		LICENSE
MAINTAINERS.md		MAINTAINERS.md
Makefile		Makefile
README.md		README.md
ROADMAP.md		ROADMAP.md
SECURITY.md		SECURITY.md
WISHLIST.md		WISHLIST.md
go.mod		go.mod
go.sum		go.sum

Folders and files

Latest commit

History

Repository files navigation

Optimize Your Experience with Containers. Make Your Containers Better, Smaller, More Secure and Do Less to Get There (free and open source!)

Overview

Community

Mint on the Internet

Books:

Minification Examples

RECENT UPDATES

INSTALLATION

Downloads

Scripted Install

Homebrew

Docker

BASIC USAGE INFO

COMMANDS

USAGE DETAILS

LINT COMMAND OPTIONS

XRAY COMMAND OPTIONS

SLIM COMMAND OPTIONS

DEBUG COMMAND OPTIONS

IMAGEBUILD COMMAND OPTIONS

RUN COMMAND OPTIONS

MERGE COMMAND OPTIONS

REGISTRY COMMAND OPTIONS

PULL SUBCOMMAND OPTIONS

PUSH SUBCOMMAND OPTIONS

COPY SUBCOMMAND OPTIONS

IMAGE-INDEX-CREATE SUBCOMMAND OPTIONS

SERVER SUBCOMMAND OPTIONS

VULNERABILITY COMMAND OPTIONS

EPSS SUBCOMMAND OPTIONS

RUNNING CONTAINERIZED

Using *-file Flags

CI/CD INTEGRATIONS

Integrating Mint in Jenkins

Prerequisites:

Jenkinsfile Slim Stage

Integrating Mint in Github Actions

Docker-Slim Github Action

Github Actions Workflow

DOCKER CONNECT OPTIONS

DOCKER DESKTOP

HTTP PROBE COMMANDS

DEBUGGING MINIFIED CONTAINERS

Debugging Using the debug Command

Podman Runtime

ContainerD Runtime

The Debug Images

Steps to Debug Your Container (Kubernetes Runtime)

Steps to Debug Your Container (Docker Runtime)

Debugging the "Hard Way" (Docker Runtime)

Talks and Presentations about Debugging

MINIFYING COMMAND LINE TOOLS

QUICK SECCOMP EXAMPLE

USING AUTO-GENERATED SECCOMP PROFILES

ORIGINAL DEMO VIDEO

DEMO STEPS

FAQ

Is it safe for production use?

How can I contribute if I don't know Go?

What's the best application for Mint?

Can I use Mint with dockerized command line tools?

What if my Docker images uses the USER command?

Nginx fails in my minified image

Mint fails with a 'no permission to read from' error

EXPLORE SOURCE CODE WITH AI

BUILD PROCESS

Build Options

Containerized

Native

Gitpod

Additional Tools

CONTRIBUTING

CORE CONCEPTS

DYNAMIC ANALYSIS OPTIONS

SECURITY

CHALLENGES

`LINT` COMMAND OPTIONS

`XRAY` COMMAND OPTIONS

`SLIM` COMMAND OPTIONS

`DEBUG` COMMAND OPTIONS

`IMAGEBUILD` COMMAND OPTIONS

`RUN` COMMAND OPTIONS

`MERGE` COMMAND OPTIONS

`REGISTRY` COMMAND OPTIONS

`PULL` SUBCOMMAND OPTIONS

`PUSH` SUBCOMMAND OPTIONS

`COPY` SUBCOMMAND OPTIONS

`IMAGE-INDEX-CREATE` SUBCOMMAND OPTIONS

`SERVER` SUBCOMMAND OPTIONS

`VULNERABILITY` COMMAND OPTIONS

`EPSS` SUBCOMMAND OPTIONS

Using `*-file` Flags

Debugging Using the `debug` Command

Packages