3 ms·
It's less about "could I write a program to modify bits directly?" and more about "what can I get that I won't have to support myself for the rest of time?". N
by jacques_chester 9y ago
It's less about "could I write a program to modify bits directly?" and more about "what can I get that I won't have to support myself for the rest of time?".
Nothing stops anyone from writing code to interpret Dockerfiles or to directly fiddle with image layers. But taking the cost:value ratio proportional to everything else you need to be doing, it's probably a poor investment of time.
Google has economies of scale around this exact problem, which is why they've been pumping out work in this area -- Kaniko, Skaffold, image-rebase, FTL, rules_docker, Jib etc.
- ggm 9y agoSo his story reduces down to the real problem: what tooling can I find, which runs without root, but makes images which include root outcomes, for the set of things I need in an image which can't run un-privileged, and those tools need to work without running setuid() or seteuid() to root. Thats a good story btw. I have people working near me who probably want the same thing from a lower driver, but nonetheless interest in non-root required builds.