pruneOps detects image bloat and resource waste across Docker and Kubernetes in one platform — on evidence, not guesswork — and remediates it in stages.
in-cluster agent installs via Helm, read-only
dashboard + weekly Slack/PDF report live
eBPF profiling, CBOM, CVEs and orphan detection live
taking 3 design partners this cycle
56%
That is attack surface and CVE debt, directly. Static scanning cannot prove which package is genuinely unused — and the same blind spot covers cryptography: which image uses which algorithm, library or certificate is simply unknown in most organisations.
2×
Security scanners see the image, FinOps tools see the invoice, and nothing correlates the two. Meanwhile the cluster keeps swelling with orphaned volumes, dead ConfigMaps and Secrets, and oversized resource requests.
Diffing the static SBOM against the map of files eBPF actually saw execute yields a list of provably unused packages. Every finding carries a coverage score; below 70% it is flagged low-confidence and never enters an automated suggestion.
Alerts are trend-based, not threshold-based — "this image grew 50% over three builds". The default is a weekly digest; instant alerts fire only at critical thresholds. The point is not drowning in the same warning daily.
01
SBOM via Syft, CVE matching against the Trivy database — ranked by severity, with the version that fixes each — plus image size trends and layer analysis.
02
eBPF (Tetragon) traces execve/openat, so "this file never ran" is backed by a syscall record — diffed against the SBOM into a list of provably unused packages.
03
Algorithms, libraries and certificates listed in CycloneDX; MD5, SHA-1, RSA-1024, TLS 1.0 and quantum-vulnerable choices flagged with a risk score.
04
Request versus real usage, orphaned PVC/ConfigMap/Secret detection (names only — contents are never read), and sizing recommendations on Goldilocks/VPA logic.
05
Weekly PDF digest, plus Slack, Teams, PagerDuty and Opsgenie alerts. Role-based views for SecOps, DevOps/SRE and developers.
06
A GitHub pull request first — human approval always required, never merged for you. Kyverno policy checks run in shadow (audit) mode first.
Aggregation happens in the data plane — your cluster. Only summarised metrics, inventory lists and scores reach the control plane; never source code, file contents, keys or certificate material. An automated test asserts the payload carries no content.
It connects to the cluster API with read-only RBAC and holds no write permissions. Helm install takes under fifteen minutes; removing it is one command.
The PR bot gets merge rights in no phase — a deliberate decision, given the real risk of eBPF false positives. A developer can reject a suggestion and say why; the system learns that service's special case.
Policies first only log what they would have blocked. Going live happens after a false-positive blocking rate under 5% is demonstrated — and on your decision.
Phase 1 — shipped
K8s agent, static SBOM, core FinOps and image bloat, Slack/PDF reporting. No enforcement.
Exit: active use at 3 design partners.
Phase 2 — shipped
eBPF runtime profiling, CBOM, sizing recommendations, GitHub PR bot, orphan detection and CVE findings.
Exit: 60% of suggestions answered.
Phase 3 — now
Kyverno shadow-mode enforcement live; SSO/SCIM, multi-tenancy and audit logging next.
Exit: enforcement live at one customer.
Phase 4
Air-gapped / self-hosted deployment — a separate track with its own go/no-go.
Exploring
VM/host support alongside Kubernetes — SBOM, CVE and eBPF-based runtime evidence for workloads outside containers. Under evaluation, not yet scheduled.
We install the agent read-only in staging, produce a concrete waste report within 30 days, and order the roadmap around your pain. All we ask in return is half an hour a week and honest feedback.