3 ms·
Also from that ecosystem, buildah. I started using buildah to build container images in CI jobs because then the job can run in an unprivileged container, unli
by INTPenis 5y ago
Also from that ecosystem, buildah.
I started using buildah to build container images in CI jobs because then the job can run in an unprivileged container, unlike docker.
At the time I only knew of kaniko that could do this but I preferred buildah for a number of reasons.
Buildah is really awesome at multi stage builds because you can use it from bash.
- dolni 5y agoBuildah is what the Dockerfile could have been. Instead of using general-purpose shell scripting knowledge to produce images, we ended up with a custom instruction file, complete with its own quirks. I am not sure why everyone seems to think inventing their own domain-specific language is a good thing. It isn't.
- dengolius 5y agoDid you try https://github.com/werf/werf https://github.com/werf/werf ? Check authors blog with articles about werf https://blog.flant.com/tag/werf/ https://blog.flant.com/tag/werf/
- pidminusone 5y agoBuildkit has a daemonless / rootless mode nowadays.
- forty 5y agoI use kaniko a lot. Could you please expend on why you preferred buidah? (I'm happy with kaniko, and curious)
- INTPenis 5y agoFirst of all I'm a Fedora user and podman/buildah have been recommended since Fedora switched to cgroupsv2. But also I prefer using open source projects from communities and companies who are based around open source. Google do contribute a lot to open source but they're primarily an ad company who want your data. So consider using buildah a type of boycott. ;) I use buildah privately whenever I need to quickly make an image to test something, it's so simple to use in bash. It's also very simple to add to existing images while you're testing it. So it was just natural to continue using it in CI pipelines. I only ever used one command for kaniko so I'll admit I know nothing of it, and that was 2 years ago. But buildah feels a lot more accessible because I learned all the different shell commands that correspond to the Containerfile format.
- forty 5y agoI found that it was convenient to reuse Dockerfile rather than learning a new domain specific language and also for some reasons I was not able to use podman inside docker when I tried (our CI runs in docker containers) while kaniko works well inside docker. I'll have a second look to podman, maybe it's better now.
- chriswarbo 5y agoI build container images using plain old tar, gzip, sha256sum (from GNU coreutils) and jq. No need for root access, etc.