3 ms·
Seems like a good idea for new project. The article says "You don't have to create a Dockerfile" but honestly, who does? There are a ton of Gradle/SBT/Maven pl
by djsumdog 8y ago
Seems like a good idea for new project. The article says "You don't have to create a Dockerfile" but honestly, who does?
There are a ton of Gradle/SBT/Maven plugins that build your container for you. Most call your Docker daemon API directly, copy in all your jars and write a startup script. Some generate a Dockerfile, but they stick it in your build directly and you never touch it directly.
The advantage is not needing a Docker daemon. That is pretty nice. However I already need a daemon in our Jenkins pipeline and a lot of my unit tests use the Scala testcontainers framework (so I can run tests against a real MySQL or Postgres DB, which is way nicer than using mocks or H2).
So it is nice, but chances are, we're already running container daemons everywhere already.
Plus I'm sure for this to be really useful, we'll need ECR plugins as well (which will probably need to be 3rd party because I don't see Google supporting AWS officially).
I wouldn't move to this if I was on something that worked. That previous article about the team going back to maven after a gradle migration is kinda in that same view: with a new project you can make it clean, but your current project is probably so customized around your workflow that unless you can make a case for a really bad pain point it will solve, it's probably not worth it.
A good pain point I think this would solve is if your CI doesn't have access to a Docker daemon at all (for security or you're using a hosted solution or whatever) and you want to be able to build containers and publish them in your CI.
- jacques_chester 8y agoThere's two things here. The first is layering. A goal is smarter layering without a Dockerfile. A dependency-management tool gives fairly good insight into how to arrange layers to improve cacheability and reduce layer churn. The second is security. Going without a daemon socket is more than "pretty nice", it is a massive security win. Docker daemons have a lot of privileged access and a wide API. Having that entire massive attack surface lying around to write some tarballs and a JSON file on your behalf doesn't make a great deal of sense. These both become more valuable at large scales, which is why it makes sense for Google folks to have developed it.
- kronin 8y agoAgreed re: both of these wins. On the security front, would be ideal if these resulting containers ran as non-root. Hopefully that will come soon.
- jonjonsonjr 8y agoIf jib doesn't work against ECR, please file a bug. There isn't anything specific to Google here -- it's all based on standard container tooling. The only thing you should need to do is configure the ECR credential helper: https://github.com/awslabs/amazon-ecr-credential-helper https://github.com/awslabs/amazon-ecr-credential-helper