Buildpacks: the
other way to build
container images
Confoo, February 23th 2023
Anthony Dahanne
Software Engineer
@anthonydahanne@framapiaf.org
https://blog.dahanne.net
2
Picture Placehlder Picture Placeholder Picture Placeholder
https://github.com/anthonydahanne
Montreal JUG co-lead
Your presenter for this session
Java and Go developer, Cloud architect, Devops guy… But also community leader!
blog.dahanne.net
@anthonydahanne@framapiaf.org
Devoxx4kids QC co-lead CNCF Eastern Canada co-organizer
Agenda
4
• What are container images? How to build them?
• CNCF Buildpacks
• How to use and configure them
• Paketo Buildpacks
• Buildpacks Integrations
5
Container Images
aka OCI images
aka Docker images
6
Intro: quick recap about the container
• It’s usually an isolated process
• Isolation performed with chroot, namespaces, cgroups
• namespaces : limit what you can see
– pid, net, mnt, uts, ipc, user
• cgroups : limit what you can use
– memory, CPU, block IO, network (with iptables)
• In terms of packaging, it’s a bunch of layers on top
of the host kernel
Kernel (from OS)
Base image (distroless / debian)
Add JVM (RUN apt install)
Add Jar (COPY or ADD)
Metadata (LABEL, USER, etc.)
Run Jar (ENTRYPOINT java -jar)
7
Containerizing (building an image) with a Dockerfile
• 2014: using Dockerfile
• 2017: multi-stage builds
FROM openjdk
COPY target/*runner.jar /app/app-runner.jar
WORKDIR /app
EXPOSE 8080
ENTRYPOINT [ "java","-jar" ]
CMD ["app-runner.jar"]
./mvnw clean package
docker build -f src/main/docker/Dockerfile -t myapp .
FROM openjdk as build
COPY . /workspace
WORKDIR /workspace
RUN ./mvnw clean package
FROM azul/zulu-openjdk-alpine
COPY --from=build /workspace/target/*runner.jar /app/app-runner.jar
WORKDIR /app
EXPOSE 8080
ENTRYPOINT [ "java","-jar" ]
CMD ["app-runner.jar"]
docker build -f src/main/docker/Dockerfile.multi -t myapp .
8
Other options to build a container image
• Jib: a Java library that can create a container image without a Docker daemon
• KO build: a Go library that can create a container image without a Docker daemon
• Kaniko: uses a Dockerfile, but builds the image without a Docker daemon
9
Cloud Native Buildpacks
aka Buildpacks v3
aka CNCF Buildpacks
10
Buildpacks: first contact, the spec and the pack CLI
• Heroku and CloudFoundry have been using them since… 2011 !
• Accepted in CNCF sandbox (2018) and then CNCF incubation (November 2020)
• Buildpacks are based on a spec combining several concepts
• Lifecycle
• Builders
• Buildpacks
• Stacks
• The pack CLI is the default implementation, but others exist (more on that later)
11
Buildpacks: simplified high level view
third
builder
second
buildpackA
buildpackB buildpackC
stack
run image build
image
bin/detect
bin/build
buildpack.toml
builder.toml
12
Buildpacks: use and configure existing buildpacks
• Why customize ?
• You may want to choose a different JVM vendor or version
• You may want to include a CA Certificate in your image
• You may need to instruct Maven or Gradle to use an internal proxy for dependencies
• etc.
● Rebase: use the latest and greatest base/run image
pack rebase demo:0.0.1-SNAPSHOT
● Where to find them?
https://registry.buildpacks.io/
13
Paketo Buildpacks
• Come in 3 flavor: tiny, base and full
• The tinier, the lighter
• The fuller, the more detections
§ A wide range of programming languages and tools and frameworks supported
§ Java, Go, .NET, Python, Ruby, NodeJS - Spring Boot, Pip, Gems, Yarn, etc.
§ A common set of advanced features
§ Custom CA Certificates, SBOM generation (syft), extra labelling, etc.
§ 2023 Roadmap includes: ARM64 support, new stacks and builders, additional SBOM options
14
Buildpacks: integrations
§ Spring Boot Maven / Gradle plugins
§ Waypoint
§ Github Actions
§ CircleCI
§ Tekton
§ Skaffold
§ KPack
§ PaaS : Heroku, Google Cloud, Tanzu Application Platform, etc.
§ And other CI tools
Thank You

Buildpacks: the other way to build container images

  • 1.
    Buildpacks: the other wayto build container images Confoo, February 23th 2023 Anthony Dahanne Software Engineer @anthonydahanne@framapiaf.org https://blog.dahanne.net
  • 2.
  • 3.
    Picture Placehlder PicturePlaceholder Picture Placeholder https://github.com/anthonydahanne Montreal JUG co-lead Your presenter for this session Java and Go developer, Cloud architect, Devops guy… But also community leader! blog.dahanne.net @anthonydahanne@framapiaf.org Devoxx4kids QC co-lead CNCF Eastern Canada co-organizer
  • 4.
    Agenda 4 • What arecontainer images? How to build them? • CNCF Buildpacks • How to use and configure them • Paketo Buildpacks • Buildpacks Integrations
  • 5.
    5 Container Images aka OCIimages aka Docker images
  • 6.
    6 Intro: quick recapabout the container • It’s usually an isolated process • Isolation performed with chroot, namespaces, cgroups • namespaces : limit what you can see – pid, net, mnt, uts, ipc, user • cgroups : limit what you can use – memory, CPU, block IO, network (with iptables) • In terms of packaging, it’s a bunch of layers on top of the host kernel Kernel (from OS) Base image (distroless / debian) Add JVM (RUN apt install) Add Jar (COPY or ADD) Metadata (LABEL, USER, etc.) Run Jar (ENTRYPOINT java -jar)
  • 7.
    7 Containerizing (building animage) with a Dockerfile • 2014: using Dockerfile • 2017: multi-stage builds FROM openjdk COPY target/*runner.jar /app/app-runner.jar WORKDIR /app EXPOSE 8080 ENTRYPOINT [ "java","-jar" ] CMD ["app-runner.jar"] ./mvnw clean package docker build -f src/main/docker/Dockerfile -t myapp . FROM openjdk as build COPY . /workspace WORKDIR /workspace RUN ./mvnw clean package FROM azul/zulu-openjdk-alpine COPY --from=build /workspace/target/*runner.jar /app/app-runner.jar WORKDIR /app EXPOSE 8080 ENTRYPOINT [ "java","-jar" ] CMD ["app-runner.jar"] docker build -f src/main/docker/Dockerfile.multi -t myapp .
  • 8.
    8 Other options tobuild a container image • Jib: a Java library that can create a container image without a Docker daemon • KO build: a Go library that can create a container image without a Docker daemon • Kaniko: uses a Dockerfile, but builds the image without a Docker daemon
  • 9.
    9 Cloud Native Buildpacks akaBuildpacks v3 aka CNCF Buildpacks
  • 10.
    10 Buildpacks: first contact,the spec and the pack CLI • Heroku and CloudFoundry have been using them since… 2011 ! • Accepted in CNCF sandbox (2018) and then CNCF incubation (November 2020) • Buildpacks are based on a spec combining several concepts • Lifecycle • Builders • Buildpacks • Stacks • The pack CLI is the default implementation, but others exist (more on that later)
  • 11.
    11 Buildpacks: simplified highlevel view third builder second buildpackA buildpackB buildpackC stack run image build image bin/detect bin/build buildpack.toml builder.toml
  • 12.
    12 Buildpacks: use andconfigure existing buildpacks • Why customize ? • You may want to choose a different JVM vendor or version • You may want to include a CA Certificate in your image • You may need to instruct Maven or Gradle to use an internal proxy for dependencies • etc. ● Rebase: use the latest and greatest base/run image pack rebase demo:0.0.1-SNAPSHOT ● Where to find them? https://registry.buildpacks.io/
  • 13.
    13 Paketo Buildpacks • Comein 3 flavor: tiny, base and full • The tinier, the lighter • The fuller, the more detections § A wide range of programming languages and tools and frameworks supported § Java, Go, .NET, Python, Ruby, NodeJS - Spring Boot, Pip, Gems, Yarn, etc. § A common set of advanced features § Custom CA Certificates, SBOM generation (syft), extra labelling, etc. § 2023 Roadmap includes: ARM64 support, new stacks and builders, additional SBOM options
  • 14.
    14 Buildpacks: integrations § SpringBoot Maven / Gradle plugins § Waypoint § Github Actions § CircleCI § Tekton § Skaffold § KPack § PaaS : Heroku, Google Cloud, Tanzu Application Platform, etc. § And other CI tools
  • 15.