[Sandbox] BLAFS

[ahmedaley]

Application contact email(s)

ahmed.aley@gmail.com, huaifengzhang@outlook.com

Trademark and accounts

• If the project is accepted, I agree to donate all project trademarks and accounts to the CNCF

Contributing or sponsoring entity contact email(s)

ahmed.aley@gmail.com, huaifengzhang@outlook.com

Project summary

A container debloating tool that works with complex workloads

Project description

Most containers are bloated with unused files that inflate image sizes, increase provisioning times, and waste resources. Existing debloating tools are limited in scope and effectiveness, failing to address the widespread issue of container bloat at scale. BLAFS addresses bloat at the filesystem level by introducing a flexible debloating layer that preserves the layered structure of container filesystems. The debloating layer can be organized in different ways to meet diverse requirements including security hardening, enabled layered-sharing, and partial layer sharing.

Org repo URL (provide if all repos under the org are in scope of the application)

N/A

Project repo URL in scope of application

https://github.com/negativa-ai/BLAFS

Additional repos in scope of the application

No response

Website URL

https://github.com/negativa-ai/BLAFS

Roadmap

https://github.com/negativa-ai/BLAFS/issues?q=is%3Aissue%20state%3Aopen%20type%3AFeature

Roadmap context

We will be integrating BLAFS with multiple CI/CD platforms, supporting platforms such as Podman, and improving the deployability of the tool

Contributing guide

https://github.com/negativa-ai/BLAFS/blob/main/CONTRIBUTING.md

Code of Conduct (CoC)

https://github.com/negativa-ai/BLAFS/blob/main/CONDUCT.md

Adopters

No response

Maintainers file

https://github.com/negativa-ai/BLAFS/blob/main/MAINTAINERS.md

Security policy file

https://github.com/negativa-ai/BLAFS/blob/main/SECURITY.md

IP policy

• If the project is accepted, I agree the project will follow the CNCF IP Policy

Will the project require a license exception?

We are currently using MIT license, which we believe is in the allowlist. We are happy to switch to Apache 2.0, if necessary.

Standard or specification?

N/A

Why CNCF?

Our project was started as an academic research project. However, from talking to many people in different industries, we were told that this will be useful for their workloads, but they would like to see this as part of CNCF to be able to use it as it will mean there will hopefully be more maintainers than two academics. We would like to be able to create a community around the project, integrate it with as many CI/CD systems as we can, and make sure that the project remains open-sourced rather than, e.g., keeping it closed at a company.

Benefit to the landscape

We have done a very thorough evaluation on exisiting deblaoting tools here: https://arxiv.org/abs/2305.04641
Basically, our tool is the only tool we know of capable of supporting very complex and large containers such as Machine Learning containers and able to support layer sharing. Our tool is also much more reliable than all other exisiting tools we know of.

Cloud native 'fit'

BLAFS fits in the "Container Registry", "Automation & Configuration", and "Security & Compliance" landscape categories.

Cloud native 'integration'

N/A

Cloud native overlap

SlimToolKit: https://github.com/slimtoolkit/slim

Similar projects

Cimplifier which is an academic project recently open-sourced also by us: https://github.com/negativa-ai/MMLB/tree/main/external/cimplifier

Landscape

No

Business Product or Service to Project separation

At the moment, this project is unrelated to any product or service.

Project "Domain Technical Review"

No response

CNCF contacts

No response

Additional information

This project started as part of Huaifeng's PhD and has a full academic report with detailed evaluations: https://arxiv.org/abs/2305.04641

[dims]

@ahmedaley Do you have a writeup of some sort on how to use this with k8s? transparently? (even a very rough outline using any one of the kubernetes distros or kubeadm/kind/minikube)

[jzh18]

@ahmedaley Do you have a writeup of some sort on how to use this with k8s? transparently? (even a very rough outline using any one of the kubernetes distros or kubeadm/kind/minikube)

Hi Dims, we are working on this and there is WIP PR for this purpose: reSecureIt/BLAFS#22

[ahmedaley]

@ahmedaley Do you have a writeup of some sort on how to use this with k8s? transparently? (even a very rough outline using any one of the kubernetes distros or kubeadm/kind/minikube)

@dims As Huaifeng posted, we are working on the integration at the moment. We are happy to also provide a writeup. Tomorrow, we will be presenting BLAFS at tag-security (cncf/tag-security#1481).

I can start working on a detailed write-up after that if needbe.

[dims]

@ahmedaley was curious, not asking for it explicitly for evaluating this proposal :)

[angellk]

@marina

[dims]

@ahmedaley The TOC reviewed this during our Sandbox review meeting and we think that it is a little early for this submission and would like to ask that you revisit this in 6 months. We felt that this project is still very early in its lifecycle. We would like to see a bit more activity, adoption, releases before we evaluate again. This is indeed a valuable problem to be working on for sure, having more out of the box scenarios for the folks who work on CNCF projects to show the value to them will help bring in more contributors we think. Thanks!

[ahmedaley]

@dims Thank you very much! We will be doing exactly that! Will revisit in 6 months!