Q: Your team's Node.js and Python microservice container images are between 1.2GB and 1.8GB because they inherit heavyweight base images with unused system compilers, locales, documentation, and thousands of dead files. Image pulling in production takes over 45 seconds during autoscaling events. The platform team wants to minify these images down to under 50MB using DockerSlim without manually re-authoring every Dockerfile from scratch. You must configure dynamic profiling probes to capture all dynamic runtime dependencies, handle hidden plugins, and output fully verified slim images.

DockerSlim inspects images in two phases: Static analysis inspects layer contents and ELF binaries. Dynamic analysis spins up an ephemeral container instance, injects a ptrace/fanotify sensor, executes automated HTTP probes or custom test scripts, and records every file accessed and syscall made by the running process.

<!-- DockerSlim Profiling Flow -->
Fat Image (1.5GB) ───> DockerSlim Container Probe (ptrace/fanotify/seccomp)
                             │ (Executes HTTP probes & integration tests)
                             └───> Strips 95% unused binaries & docs
                             └───> Emits: Slim Image (35MB) + Seccomp/AppArmor Profile

Run `slim build` against the fat image, configuring HTTP probe targets, startup timeouts, and port exposure to ensure the dynamic sensor exercises standard application routes.

# Minify fat Node.js image with automated HTTP probing
slim build \
  --target my-fat-node-app:1.0 \
  --tag my-slim-node-app:1.0 \
  --http-probe-cmd /api/health \
  --http-probe-cmd /api/v1/users \
  --http-probe-ports 3000 \
  --exec-file ./integration-smoke-test.sh \
  --continue-after 10

Interpreted runtimes (Python/Node/Ruby) often lazy-load libraries (e.g., dynamic `.so` modules, database drivers, or SSL root certificates) that aren't touched during simple health checks. Explicitly preserve required directory paths using `--include-path`.

slim build \
  --target python-ml-service:latest \
  --tag python-ml-service:slim \
  --include-path /usr/local/lib/python3.11/site-packages/sklearn \
  --include-path /etc/ssl/certs \
  --include-bin /bin/sh \
  --http-probe=true

Validate the slimmed container by executing end-to-end integration tests. Inspect the generated seccomp profile (`slim.app-seccomp.json`) which automatically blocks unused kernel syscalls based on observed runtime traces.

# Compare image sizes
docker images --filter reference="*node-app*"
# fat: 1.45GB -> slim: 42.1MB (97% reduction!)

# Run the slimmed container enforcing generated seccomp profile
docker run -d -p 3000:3000 \
  --security-opt seccomp=my-slim-node-app-seccomp.json \
  my-slim-node-app:1.0