Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Container Build: Kaniko and Friends

Container Build: Kaniko and Friends

sakajunquality

May 13, 2019
Tweet

More Decks by sakajunquality

Other Decks in Technology

Transcript

  1. About me - Jun Sakata - @sakajunquality - Software Engineer

    at Ubie, Inc. - Google Developers Expert, Cloud - #kubelet #envoy #DarkTheme
  2. Where do you build container image? Probably building ... -

    Locally - On Public Cloud CIs / Other CIs - On Kubernetes
  3. On Public Cloud CIs / Other CIs... - Public Cloud

    - Google Cloud Build - AWS CodeBuild - Third Party - CircleCI - GitLab CI - etc...
  4. How do you build container image? - Kaniko - other

    friends - BuildKit - img - jib - buildah - Bazel - etc...
  5. How do you build container image? - Kaniko - other

    friends - BuildKit - img - jib - buildah - Bazel - etc...
  6. Docker Multi Stage Build (recap) // Dockerfile ARG PLATFORM=alpine FROM

    golang:${PLATFORM} as golang-base FROM ${PLATFORM} as alpine-base FROM golang-base as build RUN go build ... FROM alpine-base as run-time COPY --from=build /go/bin/my-app /usr/local/bin/my-app
  7. Docker Multi Stage Build (recap) - Since Docker 17.05 -

    Files can be shared between stages - Effectively reduce the image size - Even decide which stage to build finally: w/ --target option - Unnecessary part will be ignored
  8. Docker Multi Stage Build (recap) - Medium Blog: Advanced multi-stage

    build patterns - https://medium.com/@tonistiigi/advanced-multi-stage-build-patterns-6f741b852fae - DockerCon US 2019: Dockerfile Best Practices - https://www.slideshare.net/Docker/dcsf19-dockerfile-best-practices
  9. What is Kaniko? - Tool for creating a container image

    - OSS by Google - https://github.com/GoogleContainerTools/kaniko
  10. What is Kaniko? - With Dockerfile - Without Docker daemon

    - Without a root privileges - Has layer cache
  11. Why Kaniko? - DinD Problem - Some environment cannot expose

    Docker daemon - e.g. within Kubernetes - Or to complete image build within user namespace
  12. If you’re using, Google Cloud Build - BuildKit is not

    supported. - But Kaniko is supported. - Simply gcloud config set builds/use_kaniko True
  13. If you’re using, AWS CodeBuild - BuildKit is supported. -

    Docker v18.09 - And Kaniko should work. - as Kaniko supports S3 as cache destination
  14. If you want to build on Kubernetes... - Kaniko might

    be for you - It works on gVisor as well - --runtime=runsc
  15. Without Docker Daemon - Kaniko does not require Docker Daemon

    - Each commands run in userspace - Kaniko itself is prepared as image
  16. Example config // cloudbuild.yaml steps: - name: gcr.io/kaniko-project/executor args: -

    --destination=gcr.io/$PROJECT_ID/my-super-cool-app - --cache=true - --cache-ttl=6h timeout: 720s options: machineType: 'N1_HIGHCPU_8'
  17. Layer Cache - Kaniko caches layers each “RUN” - Check

    if the cache exists - If exists, pull the cache - If not, execute “RUN” - Best Practice follows the Docker’s one
  18. // Dockerfile ARG PLATFORM=alpine FROM golang:${PLATFORM} as golang-base FROM ${PLATFORM}

    as alpine-base FROM golang-base as build RUN go get … RUN go install ... FROM alpine-base as run-time COPY --from=build /go/bin/my-app /usr/local/bin/my-app How does it work? <= Check cache <= Check cache
  19. Concurrent Dependency Resolution // Dockerfile FROM golang as golang-build RUN

    aaa FROM clang as clang-build RUN bbb FROM node as node-build RUN ccc FROM alpine COPY --from=golang-build aaa . COPY --from=clang-build bbb . COPY --from=node-build ccc .
  20. Concurrent Dependency Resolution // Dockerfile FROM golang as golang-build RUN

    aaa FROM clang as clang-build RUN bbb FROM node as node-build RUN ccc FROM alpine COPY --from=golang-build aaa . COPY --from=clang-build bbb . COPY --from=node-build ccc . No Dependencies => Runs Concurrently
  21. buildx - docker buildx build ... - instead of docker

    build ... - Without DOCKER_BUILDKIT environment variables, enables BuildKit features
  22. How about other friends? - CBI to a big daddy?

    - https://github.com/containerbuilding/cbi - [UPDATED] Going to be replaced by https://github.com/tektoncd ?
  23. Takeaways - Whether to use Kaniko or BuildKit depends on

    applications or platforms running on. - I have migrated Docker to Kaniko. But rolled it back as we observed some errors with caches. - Still investigating...