Look Ma' - Building Java and Go based container images without Dockerfiles
- 1. NO DOCKERFILES! LOOK MA’… Photo by Chanaka from Pexels https://www.pexels.com/photo/cargo-container-lot-906494/ @ERICSMALLING
- 2. LOOK MA’, NO DOCKERFILES! CONTAINER IMAGES 101 ▸ Images are just a collection of tarballs ▸ Base fi lesystem and environment info a container will start from ▸ Can contain metadata: i.e. annotations/labels ▸ Commonly build from Docker fi le syntax ▸ Stored in repositories in registries (DockerHub, GCR, ECR, Quay, Harbor, etc) ▸ Standardized format: OCI Photo by Frans van Heerden https://www.pexels.com/photo/assorted-color-trailer-boxes-2881632/
- 3. LOOK MA’, NO DOCKERFILES! IMAGE LAYERS - FROM DOCKERFILE FROM maven:3-jdk-8-slim as build RUN mkdir /app/src WORKDIR /app/src COPY pom.xml pom.xml COPY src src RUN --mount=target=$HOME/.m2,type=cache mvn install FROM tomcat:8.5.21 RUN mkdir /tmp/extracted_files COPY web.xml /usr/local/tomcat/conf/web.xml COPY --from=build /app/src/target/myapp /usr/local/tomcat/webapps/myapp LABEL org.opencontainers.image.source=https://repo.mycorp.com/team-volton/redlion tomcat:8.5.21 /tmp/ extracted_files …/web.xml …/myapp LABEL org.opencontainers.i mage/source
- 4. LOOK MA’, NO DOCKERFILES! IMAGE BEST PRACTICES ▸ Minimize Footprint ▸ Layer Housekeeping ▸ Build strategies ▸ Organizational standards Photo by David McBee https://www.pexels.com/photo/tilt-shift-lens-photography-of-red-crane-miniature-392031/
- 5. Photo by Yan Krukov from Pexels https://www.pexels.com/photo/photo-of-woman-showing-frustrations-on-her-face-4458420/ I JUST WANT TO BUILD MY APP!
- 6. LOOK MA’, NO DOCKERFILES! JIB AND KO https://github.com/GoogleContainerTools/jib ▸ Build OCI images for Java applications without a Docker daemon or Docker fi le. ▸ 100% Java implementation ▸ Plugins for Maven and Gradle ▸ Allows for organizational standards via parent POM inheritance. ▸ Opinionated defaults (can be overridden)
- 7. LOOK MA’, NO DOCKERFILES! JIB AND KO https://github.com/google/ko ▸ Build OCI images for Go applications without a Docker daemon or Docker fi le. ▸ ko wraps the go build tool ▸ Effectively slides in place of “go build” ▸ Allows for organizational standards via a .ko.yaml fi le ▸ Opinionated defaults (can be overridden ▸ Kubernetes integration ▸ SBOM creation & SigStore integration
- 8. LOOK MA’, NO DOCKERFILES! MAVEN + DOCKER MVN PACKAGE .JAR DOCKER BUILD IMAGE .JAR DOCKER PUSH REGISTRY IMAGE . IMAGE IMAGE IMAGE DOCKER / K8S RUN (IMPLICIT PULL) IMAGE . CONTAINER DOCKERFILE
- 9. LOOK MA’, NO DOCKERFILES! MAVEN + DOCKER
- 10. LOOK MA’, NO DOCKERFILES! MAVEN + DOCKER
- 11. LOOK MA’, NO DOCKERFILES! MAVEN + DOCKER
- 12. LOOK MA’, NO DOCKERFILES! MAVEN + DOCKER
- 13. LOOK MA’, NO DOCKERFILES! JIB MVN PACKAGE REGISTRY IMAGE . IMAGE IMAGE IMAGE DOCKER / K8S RUN (IMPLICIT PULL) IMAGE . CONTAINER
- 14. LOOK MA’, NO DOCKERFILES! JIB
- 15. LOOK MA’, NO DOCKERFILES! JIB
- 16. LOOK MA’, NO DOCKERFILES! JIB
- 17. LOOK MA’, NO DOCKERFILES! GO + DOCKER GO BUILD BIN DOCKER BUILD IMAGE BIN DOCKER PUSH REGISTRY IMAGE . IMAGE IMAGE IMAGE DOCKER / K8S RUN (IMPLICIT PULL) IMAGE . CONTAINER DOCKERFILE
- 18. LOOK MA’, NO DOCKERFILES! GO + DOCKER
- 19. LOOK MA’, NO DOCKERFILES! GO + DOCKER
- 20. LOOK MA’, NO DOCKERFILES! GO + DOCKER
- 21. LOOK MA’, NO DOCKERFILES! KO KO BUILD REGISTRY IMAGE . IMAGE IMAGE IMAGE DOCKER / K8S RUN (IMPLICIT PULL) IMAGE . CONTAINER
- 22. LOOK MA’, NO DOCKERFILES! KO
- 23. LOOK MA’, NO DOCKERFILES! KO
- 24. LOOK MA’, NO DOCKERFILES! KO KO BUILD REGISTRY IMAGE . IMAGE IMAGE IMAGE DOCKER / K8S RUN (IMPLICIT PULL) CONTAINER IMAGE . REKOR SBOM
- 25. LOOK MA’, NO DOCKERFILES! KO + K8S KO BUILD REGISTRY IMAGE . IMAGE IMAGE IMAGE REKOR SBOM KUBECTL .YAML
- 26. LOOK MA’, NO DOCKERFILES! KO + K8S KO APPLY REGISTRY IMAGE . IMAGE IMAGE IMAGE REKOR SBOM .YAML
- 27. LOOK MA’, NO DOCKERFILES! KO + K8S
- 28. LOOK MA’, NO DOCKERFILES! KO + K8S
- 29. PROS & CONS
- 30. LOOK MA’, NO DOCKERFILES! PROS ▸ Simplicity ▸ Hides complexity ▸ Developers can focus on their core strengths ▸ Streamlines processes Photo by Erik Geiger from Pexels https://www.pexels.com/photo/close-up-on-engine-start-button-in-car-7085726/
- 31. LOOK MA’, NO DOCKERFILES! PROS ▸ Guidance & Governance ▸ Opinionated defaults reviewed by the open source community but overridable as needed ▸ Org / Team speci fi cs can be managed using existing tools (i.e. Parent POM) ▸ Fosters a culture of automation over manual tasks / tribal knowledge Photo by Nextvoyage https://www.pexels.com/photo/brown-asphalt-road-beside-lake-730662/
- 32. LOOK MA’, NO DOCKERFILES! PROS ▸ Security ▸ Minimal images limit attack blast radius ▸ Automation produces deterministic results and is auditable ▸ Standardized processes limit human error Photo by Scott Webb https://www.pexels.com/photo/two-gray-bullet-security-cameras-430208/
- 33. LOOK MA’, NO DOCKERFILES! CONS ▸ Black Box / Magic ▸ Abstracting away complexity can focus knowledge on a few, specialized people ▸ Lack of ability to troubleshoot container technologies because it’s not understood but the wider team ▸ Burnout of the few that do understand it ▸ Outages if nobody understands it Image by @docker (@laurelcomics ) https://twitter.com/Docker/status/1239256807366934530
- 34. LOOK MA’, NO DOCKERFILES! CONS ▸ Security complacency ▸ With image creation “magically” happening, image scanning can get forgotten ▸ Vulnerabilities found in un-updated images, packages, libraries, etc can be missed ▸ Continuous scans via build scripts or other tooling can help. (automate, automate, automate) Image by @docker (@laurelcomics ) https://twitter.com/Docker/status/1239256807366934530
- 35. LOOK MA’, NO DOCKERFILES! CONS ▸ Docker fi les are not that dif fi cult ▸ Syntax is pretty simple ▸ Best practices are well documented ▸ Linter’s and scanners exist to catch issues Image by @docker (@laurelcomics )
- 36. LOOK MA’, NO DOCKERFILES! RESOURCES ▸ jib: https://github.com/GoogleContainerTools/jib ▸ My blog: https://snyk.io/blog/building-java-container-images-using-jib/ ▸ ko: https://github.com/google/ko ▸ Stanley Nguyen video: https://youtu.be/TpfKCE9uyCA ▸ Docke fi le reference docs: https://docs.docker.com/engine/reference/builder/ ▸ My blog on image annotations/labels: https://snyk.io/blog/how-and-when-to-use-docker-labels-oci-container-annotations/ ▸ Examples used in these slides: https://github.com/ericsmalling/alt-image-builders https://dockr.ly/TortoiseAcres @ERICSMALLING