Support for deterministic containers

[salrashid123]

I'm evaluating buck2 with the specific intent to generate container images that are deterministic

i do know you can do this with bazel and in golang with ko:

• https://blog.bazel.build/2015/07/28/docker_build.html

but the state of the underlying library set is...well:

• https://github.com/bazelbuild/rules_docker#status

i manged to build a simple go app with buck2 but struggling to find an example that would generate a container image.

Is this even possible with buck2 at the moment (any examples would go a long way).

[thoughtpolice]

Unfortunately this task is highly non-trivial in general as you can see from the implementation of something like those docker_build rules. I suspect this is unfortunately one of those cases where the answer is "no, but patches are welcome"

There are alternatives to crafting an entire bespoke filesystem image yourself, some tools can help you. For example, the tool buildah can create an OCI image from a directory you give it, so you can craft any filesystem layout for the container you want. I suspect this would be a great solution for Go binaries — you can just put the binary in a directory, pack it into an OCI image, and then ship that to your container registry. This is what people typically call "distroless containers", as they only contain your binary and whatever else they need (other binaries, maybe config files or startup scripts). This assumes your binary is fully statically linked. A rule like this, buildah_container_image or something, is probably ~30ish lines of Starlark total.

https://github.com/containers/buildah/blob/main/demos/buildah-scratch-demo.sh

If you do need distro-based containers, or something like them (e.g. your go app uses cgo and therefore needs libc.so.6), you can still use something like buildah. But you'd be on the hook for also populating a filesystem root for the container to use, based on some distro of your choosing. That's... it's own whole story.

[ndmitchell]

I think the answer is it's possible with the Buck2 core, but someone would need to write the Starlark. Maybe something like https://github.com/facebookincubator/antlir has some of the parts? CC @vmagro who might know.

[salrashid123]

atleast in my case, i'll use kaniko or since the primary app is in go, the DIY approach with buildah.

I'll leave this open incase anyone wants to implement. thanks

[imjasonh]

I think rules_oci is the successor to rules_docker, FWIW: https://github.com/bazel-contrib/rules_oci