BuildKit in depth: Docker's build engine explained

Re:BuildKit in depth: Docker's build engine explained by codethief on Tuesday February 06, 2024 @09:34PM (#39283789)

Does anyone have a good reference on how exactly Docker/BuildKit/Podman/… build Dockerfiles or, more generally, run containers using the underlying OCI container runtime (runc/crun/…)? I think I have a rough understanding but I'm particularly interested in how exactly the rootless setup works, the details of layer caching (beyond "it uses overlayfs"), etc.

[ Parent | on HN ]

Re:BuildKit in depth: Docker's build engine explained by ttymck on Tuesday February 06, 2024 @09:39PM (#39283816)

I got familiar with container intervals via, basically, "building images without docker"

One example: https://ravichaganti.com/blog/2022-11-28-building-container-...

[ Parent | on HN ]

Re:BuildKit in depth: Docker's build engine explained by codethief on Wednesday February 07, 2024 @12:00AM (#39284686)

Thanks for the link!

> I got familiar with container intervals via, basically, "building images without docker"

That's been my approach, as well. However, right now I'm stuck at getting overlayfs to work without privileges (easy: use `unshare`), while not breaking rootless runc (apparently not so easy).

[ Parent | on HN ]

Re:BuildKit in depth: Docker's build engine explained by codethief on Wednesday February 07, 2024 @09:00AM (#39288639)

EDIT: I solved my issue. Looks like I don't need to `unshare` by hand but runc actually does this already:

https://github.com/psanford/runc-examples/blob/master/rootle...

[ Parent | on HN ]

Re:BuildKit in depth: Docker's build engine explained by c0wb0yc0d3r on Tuesday February 06, 2024 @11:39PM (#39284558)

Did you ever try running any containers without pushing to a registry? That is the part I can't wrap my head around yet? How do I get the run time to start the container locally?

[ Parent | on HN ]

Re:BuildKit in depth: Docker's build engine explained by codethief on Wednesday February 07, 2024 @12:01AM (#39284694)

I'm not sure I'm following. What part of running a container would entail pushing anything to a registry?

[ Parent | on HN ]

Re:BuildKit in depth: Docker's build engine explained by ttymck on Wednesday February 07, 2024 @01:06AM (#39285078)

You can build an image with docker, and run it locally.

You can also use docker save to get a tarball and ship that file to another machine, which can be run through docker load and then run as if it was built locally.

If you have an oci bundle, you might look at runc instead: https://github.com/opencontainers/runc

[ Parent | on HN ]

Re:BuildKit in depth: Docker's build engine explained by kylegalbraith on Wednesday February 07, 2024 @12:38AM (#39284915)

Not to shill another blog post of ours in here, but maybe this is helpful.

It's not exactly what you're asking for as it relates to running containers via runc. But this walks through how OCI layers are actually built up behind the scenes. In case it's helpful: https://depot.dev/blog/building-container-layers-from-scratc...

[ Parent | on HN ]

Re:BuildKit in depth: Docker's build engine explained by codethief on Sunday February 11, 2024 @06:10PM (#39339754)

Thanks, I had come across that post already but I find the structure of OCI images to be the easy part to understand. The tougher part is to get runc to run everything without root. :)

Anyway, fortunately I seem to have found a solution for now (running runc with an overlay rootfs without root), see the link in the other sibling/nephew comment I posted.

[ Parent | on HN ]