4 ms·

I agree that Dockerfile has some constraints, but I'm not sure I get the "magic" part. It's also not like it's a full language. Run a command, set an env var. T

I agree that Dockerfile has some constraints, but I'm not sure I get the "magic" part. It's also not like it's a full language. Run a command, set an env var. There's some additional flags to set for optimizations. Otherwise minimal things to get you to an env in a container that you can do whatever you want. Also +1 to dagger+cue. I like that it gives me essentially for full power in buildkit's llb exposed as cue configs.

zamalek 4y ago
> I'm not sure I get the "magic" part The problem I was trying to solve was container signing, as well as building AMD64+ARM64 multi-arch images without buildx having access to both contexts, i.e. on different VMs (a CircleCI limitation). When you use buildah without bud you learn just how many implicit steps are involved in a Dockerfile, and how those implicit steps have been the problem all along. buildx works great when you're on the razor thin happy path. The abstraction is great for the majority who need it but, crucially, Dockerfiles provide no way to escape the abstractions.
forty 4y ago
My latest story with Dockerfile: my.tar contains files owned by user 0, I want them to be owned by nobody: USER nobody ADD --chown nobody:nobody my.tar /app Damn, --chown does not work when untaring and doesn't fail either but the files end up being owned by root. Fine, I'll just chmod USER nobody ADD my.tar /app RUN chmod -R nobody:nobody /app Now it fails (of course) because the files are owned by root and the command is ran as nobody. While it all makes sense, I'm not sure why it's logic to have the ADD command always run as root and the others following the USER directive (yeah and I know, it's all my bad for using ADD rather then COPY)
- zamalek 4y ago
  > RUN chmod -R nobody:nobody /app Did you know: RUNning chmod increases the size of the layer by the size of the file being chmodded[1]. Just some more of that magical secret sauce. (With buildah you choose when to create a layer, so both the COPY and the chmod can be layered together) [1]: https://blog.vamc19.dev/posts/dockerfile-copy-chmod/ https://blog.vamc19.dev/posts/dockerfile-copy-chmod/
  - forty 4y ago
    Ah well, no I did not know, thanks :) in my case it's not too bad because I use kaniko's option to make a single layer of my changes, but good to know.

zamalek 4y ago

> I'm not sure I get the "magic" part The problem I was trying to solve was container signing, as well as building AMD64+ARM64 multi-arch images without buildx having access to both contexts, i.e. on different VMs (a CircleCI limitation). When you use buildah without bud you learn just how many implicit steps are involved in a Dockerfile, and how those implicit steps have been the problem all along. buildx works great when you're on the razor thin happy path. The abstraction is great for the majority who need it but, crucially, Dockerfiles provide no way to escape the abstractions.

forty 4y ago

My latest story with Dockerfile: my.tar contains files owned by user 0, I want them to be owned by nobody: USER nobody ADD --chown nobody:nobody my.tar /app Damn, --chown does not work when untaring and doesn't fail either but the files end up being owned by root. Fine, I'll just chmod USER nobody ADD my.tar /app RUN chmod -R nobody:nobody /app Now it fails (of course) because the files are owned by root and the command is ran as nobody. While it all makes sense, I'm not sure why it's logic to have the ADD command always run as root and the others following the USER directive (yeah and I know, it's all my bad for using ADD rather then COPY)

zamalek 4y ago
> RUN chmod -R nobody:nobody /app Did you know: RUNning chmod increases the size of the layer by the size of the file being chmodded[1]. Just some more of that magical secret sauce. (With buildah you choose when to create a layer, so both the COPY and the chmod can be layered together) [1]: https://blog.vamc19.dev/posts/dockerfile-copy-chmod/ https://blog.vamc19.dev/posts/dockerfile-copy-chmod/
- forty 4y ago
  Ah well, no I did not know, thanks :) in my case it's not too bad because I use kaniko's option to make a single layer of my changes, but good to know.