
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
docker-image-size-limit
Advanced tools
Limit your docker
image size with a simple CLI command.
Perfect to be used inside your CI process.
Read the announcing post.
pip install docker-image-size-limit
Or use our Github Action or pre-built docker image.
We support just a single command:
$ disl your-image-name:label 300MiB
your-image-name:label exceeds 300MiB limit by 114.4 MiB
Add --max-layers
flag to also lint the maximum amount of layers possible
in your image:
# If your image has 7 layers:
$ disl your-image-name:label 300MiB --max-layers=5
your-image-name:label exceeds 5 maximum layers by 2
# If your image has 5 layers:
$ disl your-image-name:label 300MiB --max-layers=5
# ok!
Add --current-size
flag to show the current size your image:
$ disl your-image-name:label 300MiB --current-size
your-image-name:label size is 414.4 MiB
your-image-name:label exceeds 300MiB limit by 114.4 MiB
Add --exit-zero
flag to force the exit code to be 0 even if there are errors:
$ disl your-image-name:label 300MiB --exit-zero
your-image-name:label exceeds 300MiB limit by 114.4 MiB
$ echo $?
0
You can combine all flags together:
$ disl your-image-name:label 300MiB --max-layers=5 --current-size --exit-zero
your-image-name:label size is 414.4 MiB
your-image-name:label exceeds 300MiB limit by 114.4 MiB
your-image-name:label exceeds 5 maximum layers by 2
Run disl
as a module:
$ python -m docker_image_size_limit your-image-name:label 300MiB
your-image-name:label exceeds 300MiB limit by 114.4 MiB
You can specify your image as:
python
python:3.6.6-alpine
You can specify your size as:
1024
30 MB
or 30 MiB
1 GB
or 1 GiB
humanfriendly
You can also import and use this library as python
code:
from docker import from_env
from docker_image_size_limit import check_image_size
oversize = check_image_size(from_env(), 'image-name:latest', '1 GiB')
assert oversize < 0, 'Too big image!' # negative oversize - is a good thing!
We also ship PEP-561 compatible type annotations with this library.
You can also use this check as a GitHub Action:
- uses: wemake-services/docker-image-size-limit@master
with:
image: "$YOUR_IMAGE_NAME"
size: "$YOUR_SIZE_LIMIT"
# optional fields:
max_layers: 5
show_current_size: false
exit_zero: false
Here's an example.
We have a pre-built image available.
First, pull our pre-built docker image:
docker pull wemakeservices/docker-image-size-limit
Then you can use it like so:
docker run -v /var/run/docker.sock:/var/run/docker.sock --rm \
-e INPUT_IMAGE="$YOUR_IMAGE_NAME" \
-e INPUT_SIZE="$YOUR_SIZE_LIMIT" \
-e INPUT_MAX_LAYERS="$YOUR_MAX_LAYERS" \
-e INPUT_SHOW_CURRENT_SIZE="true" \
-e INPUT_EXIT_ZERO="true" \
wemakeservices/docker-image-size-limit
You can use this script instead:
LIMIT=1024 # adjust at your will
IMAGE='your-image-name:latest'
SIZE="$(docker image inspect "$IMAGE" --format='{{.Size}}')"
test "$SIZE" -gt "$LIMIT" && echo 'Limit exceeded'; exit 1 || echo 'Ok!'
But I prefer to reuse tools over
custom bash
scripts here and there.
MIT.
FAQs
Unknown package
We found that docker-image-size-limit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.