pruneOps detects image bloat and resource waste across Docker and Kubernetes in one platform — on evidence, not guesswork — and remediates it in stages.
MVP · in-cluster agent installs via Helm
dashboard + weekly Slack/PDF report live
eBPF profiling and CBOM in phase 2
taking 3 design partners this cycle
56%
That is attack surface and CVE debt, directly. Static scanning cannot prove which package is genuinely unused — and the same blind spot covers cryptography: which image uses which algorithm, library or certificate is simply unknown in most organisations.
2×
Security scanners see the image, FinOps tools see the invoice, and nothing correlates the two. Meanwhile the cluster keeps swelling with orphaned volumes, dead ConfigMaps and Secrets, and oversized resource requests.
Diffing the static SBOM against the map of files eBPF actually saw execute yields a list of provably unused packages. Every finding carries a coverage score; below 70% it is flagged low-confidence and never enters an automated suggestion.
Alerts are trend-based, not threshold-based — "this image grew 50% over three builds". The default is a weekly digest; instant alerts fire only at critical thresholds. The point is not drowning in the same warning daily.
01
SBOM via Syft, CVE matching against the Trivy database, image size trends and layer analysis.
02
eBPF (Tetragon/Tracee) traces execve/openat, so "this file never ran" is backed by a syscall record.
03
Algorithms, libraries and certificates listed in CycloneDX; MD5, SHA-1, RSA-1024, TLS 1.0 and quantum-vulnerable choices flagged with a risk score.
04
Request versus real usage, orphaned PVC/ConfigMap/Secret detection, and sizing recommendations on Goldilocks/VPA logic.
05
Weekly PDF digest and Slack today; Teams, PagerDuty and Opsgenie next. Two dashboards — executive and technical.
06
A pull request first — human approval always required. Then an OPA/Kyverno policy engine, always in shadow/dry-run mode first.
Aggregation happens in the data plane — your cluster. Only summarised metrics, inventory lists and scores reach the control plane; never source code, file contents, keys or certificate material. An automated test asserts the payload carries no content.
It connects to the cluster API with read-only RBAC and holds no write permissions. Helm install takes under fifteen minutes; removing it is one command.
The PR bot gets merge rights in no phase — a deliberate decision, given the real risk of eBPF false positives. A developer can reject a suggestion and say why; the system learns that service's special case.
Policies first only log what they would have blocked. Going live happens after a false-positive blocking rate under 5% is demonstrated — and on your decision.
Phase 1 — now
K8s agent, static SBOM, core FinOps and image bloat, Slack/PDF reporting. No enforcement.
Exit: active use at 3 design partners.
Phase 2
eBPF runtime profiling, CBOM, sizing recommendations, GitHub/GitLab PR bot.
Exit: 60% of suggestions answered.
Phase 3
SSO/SCIM, multi-tenancy, OPA/Kyverno enforcement, audit logging.
Exit: enforcement live at one customer.
Phase 4
Air-gapped / self-hosted deployment — a separate track with its own go/no-go.
We install the agent read-only in staging, produce a concrete waste report within 30 days, and order the roadmap around your pain. All we ask in return is half an hour a week and honest feedback.