On Public Cloud CIs / Other CIs...
- Public Cloud
- Google Cloud Build
- AWS CodeBuild
- Third Party
- CircleCI
- GitLab CI
- etc...
Slide 8
Slide 8 text
On Kubernetes
- Maybe
- (will be covered later...)
Slide 9
Slide 9 text
Or Jenkins somewhere
- Good Luck!
Slide 10
Slide 10 text
How do you build container image?
Slide 11
Slide 11 text
How do you build container image?
- Kaniko
- other friends
- BuildKit
- img
- jib
- buildah
- Bazel
- etc...
Slide 12
Slide 12 text
How do you build container image?
- Kaniko
- other friends
- BuildKit
- img
- jib
- buildah
- Bazel
- etc...
Slide 13
Slide 13 text
How do you write Dockerfile?
Slide 14
Slide 14 text
Probably you’re using Multi Stage Build
Slide 15
Slide 15 text
Docker Multi Stage Build (recap)
// Dockerfile
ARG PLATFORM=alpine
FROM golang:${PLATFORM} as golang-base
FROM ${PLATFORM} as alpine-base
FROM golang-base as build
RUN go build ...
FROM alpine-base as run-time
COPY --from=build /go/bin/my-app /usr/local/bin/my-app
Slide 16
Slide 16 text
Docker Multi Stage Build (recap)
- Since Docker 17.05
- Files can be shared between stages
- Effectively reduce the image size
- Even decide which stage to build finally: w/ --target option
- Unnecessary part will be ignored
Slide 17
Slide 17 text
Docker Multi Stage Build (recap)
- Medium Blog: Advanced multi-stage build patterns
- https://medium.com/@tonistiigi/advanced-multi-stage-build-patterns-6f741b852fae
- DockerCon US 2019: Dockerfile Best Practices
- https://www.slideshare.net/Docker/dcsf19-dockerfile-best-practices
Slide 18
Slide 18 text
No content
Slide 19
Slide 19 text
What is Kaniko?
Slide 20
Slide 20 text
What is Kaniko?
- Tool for creating a container image
- OSS by Google
- https://github.com/GoogleContainerTools/kaniko
Slide 21
Slide 21 text
What is Kaniko?
- With Dockerfile
- Without Docker daemon
- Without a root privileges
- Has layer cache
Slide 22
Slide 22 text
Why Kaniko?
Slide 23
Slide 23 text
Why Kaniko?
- DinD Problem
- Some environment cannot expose Docker daemon
- e.g. within Kubernetes
- Or to complete image build within user namespace
Slide 24
Slide 24 text
I’m not interested in rootless.
Because I am using Managed-CI
Slide 25
Slide 25 text
I’m not interested in rootless.
Because I am using Managed-CI
Layer Cache
- Kaniko caches layers each “RUN”
- Check if the cache exists
- If exists, pull the cache
- If not, execute “RUN”
- Best Practice follows the Docker’s one
Slide 40
Slide 40 text
How does it work?
Slide 41
Slide 41 text
// Dockerfile
ARG PLATFORM=alpine
FROM golang:${PLATFORM} as golang-base
FROM ${PLATFORM} as alpine-base
FROM golang-base as build
RUN go get …
RUN go install ...
FROM alpine-base as run-time
COPY --from=build /go/bin/my-app /usr/local/bin/my-app
How does it work?
<= Check cache
<= Check cache
Concurrent Dependency Resolution
// Dockerfile
FROM golang as golang-build
RUN aaa
FROM clang as clang-build
RUN bbb
FROM node as node-build
RUN ccc
FROM alpine
COPY --from=golang-build aaa .
COPY --from=clang-build bbb .
COPY --from=node-build ccc .
Slide 52
Slide 52 text
Concurrent Dependency Resolution
// Dockerfile
FROM golang as golang-build
RUN aaa
FROM clang as clang-build
RUN bbb
FROM node as node-build
RUN ccc
FROM alpine
COPY --from=golang-build aaa .
COPY --from=clang-build bbb .
COPY --from=node-build ccc .
No Dependencies
=> Runs Concurrently
buildx
- Docker CLI plugin for BuildKit
- https://github.com/docker/buildx
Slide 59
Slide 59 text
buildx
- docker buildx build ...
- instead of docker build ...
- Without DOCKER_BUILDKIT environment variables, enables BuildKit features
Slide 60
Slide 60 text
Kaniko vs BuildKit
Slide 61
Slide 61 text
Kaniko vs BuildKit
- Concurrency
- Cache
- Security
Slide 62
Slide 62 text
Concurrency
- BuildKit can perform concurrent builds
- Kaniko cannot
Slide 63
Slide 63 text
Cache
- Kaniko
- No specifications
- BuildKit
- RUN --mount=type=cache
Slide 64
Slide 64 text
Security
- Kaniko
- Rootfull
- completely unprivileged
- https://github.com/GoogleContainerTools/kaniko/issues/106
- BuildKit
- Rootless
- Requires seccomp and AppArmor to be disabled
Slide 65
Slide 65 text
How about other friends?
Slide 66
Slide 66 text
How about other friends?
- CBI to a big daddy?
- https://github.com/containerbuilding/cbi
- [UPDATED] Going to be replaced by https://github.com/tektoncd ?
Slide 67
Slide 67 text
Let’s try...
Slide 68
Slide 68 text
Takeaways
Slide 69
Slide 69 text
Takeaways
- Whether to use Kaniko or BuildKit depends on applications or platforms
running on.
- I have migrated Docker to Kaniko. But rolled it back as we observed some
errors with caches.
- Still investigating...
Slide 70
Slide 70 text
If you’re interested in Kaniko...
Google Group
- https://groups.google.com/forum/#!forum/kaniko-users
Slide 71
Slide 71 text
Questions?
Slide 72
Slide 72 text
We’re lucky enough to have a maintainer
@_AkihiroSuda_