Application contact emails

xandergr@microsoft.com, ritazh@microsoft.com, seozerca@microsoft.com, bridget.kromhout@microsoft.com

Project Summary

Eraser is a project that helps clean up unused and vulnerable container images from nodes in a Kubernetes cluster.

Project Description

When deploying to Kubernetes, it's common for pipelines to build and push images to a cluster, but it's much less common for these images to be cleaned up. This can lead to accumulating bloat on the disk, and a host of non-compliant images lingering on the nodes.

The current garbage collection process deletes images based on a percentage of load, but this process does not consider the vulnerability state of the images. Eraser aims to provide a simple way to determine the state of an image, and delete it if it meets the specified criteria.

Org repo URL

https://github.com/Azure

Project repo URL

https://github.com/Azure/eraser

Additional repos

https://github.com/Azure/eraser-scanner-template

Website URL

https://azure.github.io/eraser/docs/

Roadmap

https://github.com/Azure/eraser/milestones

Roadmap context

We currently use GitHub milestones and a project board to track the short term roadmap

Contributing Guide

https://azure.github.io/eraser/docs/contributing

Code of Conduct (CoC)

https://azure.github.io/eraser/docs/code-of-conduct

Adopters

No response

Contributing or Sponsoring Org

https://microsoft.com

Maintainers file

Managed through GitHub Teams

IP Policy

• If the project is accepted, I agree the project will follow the CNCF IP Policy
  To pick up a draggable item, press the space bar. While dragging, use the arrow keys to move the item. Press space again to drop the item in its new position, or press escape to cancel.

Trademark and accounts

• If the project is accepted, I agree to donate all project trademarks and accounts to the CNCF
  To pick up a draggable item, press the space bar. While dragging, use the arrow keys to move the item. Press space again to drop the item in its new position, or press escape to cancel.

Why CNCF?

We would like the project to ultimately be community owned rather than Azure owned. We feel the project can provide benefit to everyone using Kubernetes, and having it belong to the community rather than a single organization will help communicate that. We would also like to grow the community of users and contributors in order to make the tool the absolute best it can be. The CNCF is the best way to go about that.

Benefit to the Landscape

While Kubernetes has its own garbage collection mechanism today, it does still regularly leave images cached on nodes. In addition to consuming storage, this opens a possible attack vector if images contain vulnerabilities. The core benefit to the landscape is helping users heighten the security of the Kubernetes clusters and the workloads running on them.

Cloud Native 'Fit'

This project helps users be more successful in running their Kubernetes clusters. Since that's where a good many "cloud native" workloads are running today, we see this as being a good fit for the entire ecosystem around Kubernetes.

Cloud Native 'Integration'

The main way that Eraser has integration potential with other CNCF projects is through it's extension mechanism. Currently, Eraser utilizes Trivy for vulnerability scanning, but it follows a plugin model, so other scanners could be implemented using the same interface. This opens up Eraser to integrating with other CNCF projects in the container security space.

Cloud Native Overlap

To our knowledge, there isn't any direct overlap with other CNCF projects today.

Similar projects

N/A

Product or Service to Project separation

Azure Kubernetes Service has developed a managed addon of the project for customer clusters. The development and roadmap of the open source project and the managed addon have always remained entirely separate, and that will continue to be true going forward.

Project presentations

The project was presented to Kubernetes SIG Security as part of their "security tooling" subproject meeting.

https://youtu.be/c1yhWxxEkJI

Project champions

Lachlan Evenson

Additional information

No response