A computer-implemented method comprising: obtaining a first container image that is formed from a set of files; determining that a first particular file of the set of files is necessary for an application and a second particular file of the set of files is not necessary for the application based on execution of the application in a first container instantiated with the first container image; in response to determining that the first particular file of the set of files is necessary for the application and the second particular file of the set of files is not necessary for the application based on execution of the application in the first container instantiated with the first container image, generating a second container image from the first particular file and not from the second particular file, wherein generating the second container image from the first particular file and not from the second particular file comprises: copying the first particular file into a subfolder in a new folder, wherein the subfolder matches a subfolder of the first particular file in the first container image; hard-coding an appropriate owner, group and permission into the first particular file copied into the subfolder in the new folder; and generating the second container image based on a subfolder structure of files, within the new folder, that includes the subfolder; and executing the application in a second container instantiated with the second container image. obtaining a first container image that is formed from a set of files; determining that a first particular file of the set of files is necessary for an application and a second particular file of the set of files is not necessary for the application based on execution of the application in a first container instantiated with the first container image; in response to determining that the first particular file of the set of files is necessary for the application and the second particular file of the set of files is not necessary for the application based on execution of the application in the first container instantiated with the first container image, generating a second container image from the first particular file and not from the second particular file, wherein generating the second container image from the first particular file and not from the second particular file comprises: copying the first particular file into a subfolder in a new folder, wherein the subfolder matches a subfolder of the first particular file in the first container image; hard-coding an appropriate owner, group and permission into the first particular file copied into the subfolder in the new folder; and generating the second container image based on a subfolder structure of files, within the new folder, that includes the subfolder; and copying the first particular file into a subfolder in a new folder, wherein the subfolder matches a subfolder of the first particular file in the first container image; hard-coding an appropriate owner, group and permission into the first particular file copied into the subfolder in the new folder; and generating the second container image based on a subfolder structure of files, within the new folder, that includes the subfolder; and executing the application in a second container instantiated with the second container image.